Passkey
Monthly
Insecure Direct Object Reference in the better-auth passkey plugin (npm/@better-auth/passkey < 1.4.0) permits any authenticated user to delete arbitrary passkeys belonging to other users via the `POST /passkey/delete-passkey` endpoint. The `ctx.body.id` parameter is implicitly trusted without ownership verification, meaning a valid session - regardless of privilege level - is sufficient to enumerate and destroy other users' passkey credentials. Applications configured with `useNumberId` (auto-incrementing integer IDs) are trivially exploitable by sequential enumeration. No public exploit or CISA KEV listing confirmed at time of analysis; a vendor-released patch exists at version 1.4.0.
Insecure Direct Object Reference in the better-auth passkey plugin (npm/@better-auth/passkey < 1.4.0) permits any authenticated user to delete arbitrary passkeys belonging to other users via the `POST /passkey/delete-passkey` endpoint. The `ctx.body.id` parameter is implicitly trusted without ownership verification, meaning a valid session - regardless of privilege level - is sufficient to enumerate and destroy other users' passkey credentials. Applications configured with `useNumberId` (auto-incrementing integer IDs) are trivially exploitable by sequential enumeration. No public exploit or CISA KEV listing confirmed at time of analysis; a vendor-released patch exists at version 1.4.0.