CVE-2025-71399 better-auth CVE debrief

Who should care

Organizations using Better Auth versions prior to 1.4.5 should be aware of the path normalization bypass vulnerability and take steps to mitigate it. This includes upgrading to version 1.4.5 or later, reviewing and adjusting disabledPaths configuration and path-based rate limits, and monitoring for suspicious requests with extra slashes in URL paths. Security teams and vulnerability management teams should also be aware of this issue and prioritize remediation efforts. Additionally, operators and administrators of affected systems should take steps to verify the vulnerability and apply mitigations as needed. This may involve reviewing system logs and monitoring for suspicious activity. By taking these steps, organizations can help prevent exploitation of this vulnerability and reduce the risk of unauthorized access to their systems and data. It is also recommended to review compensating controls for exposed systems while remediation is scheduled and verified, and to track exceptions and retest remediated assets to ensure that the vulnerability has been fully addressed. Furthermore, organizations should consider implementing additional security measures, such as enhanced monitoring and incident response planning, to help detect and respond to potential attacks. By prioritizing remediation and taking proactive steps to address this vulnerability, organizations can help protect their systems and data from potential exploitation. The CVE record was published on 2026-08-02T13:16:52.210Z and has not been modified since then. The NVD detail page for CVE-2025-71399 provides additional information on the vulnerability, including its CVSS score and severity rating. The Better Auth security advisory provides guidance on upgrading to version 1.4.5 or later and applying mitigations to address the vulnerability. The Vulncheck advisory provides additional information on the vulnerability and its potential impact on affected systems. By reviewing these resources and taking proactive steps to address the vulnerability, organizations can help protect their systems and data from potential exploitation. The issue allows attackers to bypass security configurations and potentially .

Technical summary

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, allowing attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue allows attackers to bypass security configurations and potentially gain unauthorized access. Organizations using Better Auth versions prior to 1.4.5 should prioritize upgrading to version 1.4.5 or later to address the path normalization bypass vulnerability.

Defensive priority

Organizations using Better Auth versions prior to 1.4.5 should prioritize upgrading to version 1.4.5 or later to address the path normalization bypass vulnerability.

Recommended defensive actions

• Upgrade to Better Auth version 1.4.5 or later
• Review and adjust disabledPaths configuration and path-based rate limits
• Monitor for suspicious requests with extra slashes in URL paths
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The issue allows attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. Evidence is based on official CVE and NVD records, as well as source references from [email protected].

Official resources