CVE-2025-71399 better-auth CVE debrief

Who should care

Defenders responsible for Better Auth deployments should assess exposure and verify URL normalization practices. This includes reviewing the current version of Better Auth, understanding the impact of the vulnerability on their deployments, and taking necessary actions to mitigate the risk. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2025-71399 allows attackers to bypass security configurations in Better Auth deployments, potentially leading to unauthorized access. Defenders should verify exposure, assess URL normalization practices, and update Better Auth to version 1.4.5 or later.

• Bypassing disabledPaths configuration
• Bypassing path-based rate limits
• Potential unauthorized access to sensitive data
• Need for verification of URL normalization practices

Technical summary

The rou3 library used by Better Auth normalizes paths by removing empty segments, allowing attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. This issue affects Better Auth versions prior to 1.4.5, which bundles the fixed rou3. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes. Defenders should verify exposure in Better Auth deployments and assess URL normalization practices.

Defensive priority

Defenders should prioritize verifying exposure in Better Auth deployments and assessing URL normalization practices.

Recommended defensive actions

• Verify Better Auth version and assess exposure
• Review URL normalization practices in proxy or platform
• Update Better Auth to version 1.4.5 or later
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The issue arises from the rou3 library used by Better Auth, which normalizes paths by removing empty segments. This allows attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.