CVE-2025-71401 better-auth CVE debrief

Who should care

Developers and administrators using the better-auth package in their applications should be aware of this vulnerability and take necessary actions to mitigate it. This includes verifying the package version, ensuring baseURL is explicitly configured, and monitoring server logs for suspicious activity. Additionally, security teams and vulnerability management professionals should prioritize this CVE due to its critical severity score and potential for denial of service attacks.

Technical summary

The better-auth package before version 1.4.2 allows an external request to configure baseURL when it is not otherwise defined. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). This vulnerability is particularly concerning because it can be exploited by an attacker making a single request to the server after startup, emphasizing the need for immediate attention and mitigation.

Defensive priority

This CVE requires immediate attention due to its critical severity score of 9.3 and potential for denial of service attacks.

Recommended defensive actions

• Verify the better-auth package version and update to 1.4.2 or later if necessary.
• Check if baseURL is explicitly configured in the application.
• Monitor server logs for suspicious requests that could be used to poison the router's base path.
• Consider implementing additional security measures to prevent denial of service attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). This highlights the importance of verifying the better-auth package version and ensuring baseURL is properly configured to prevent such attacks. Additionally, defenders should verify server logs for suspicious requests that could be used to poison the router's base path.

Official resources