CVE-2025-71403 better-auth CVE debrief

Who should care

Developers and administrators using better-auth versions before 1.1.20, as well as security teams monitoring for potential open redirect attacks, should prioritize upgrading to a patched version and review configurations for trustedOrigins validation to prevent potential account takeover attacks. Additionally, security teams should monitor for potential open redirect attacks and review compensating controls for exposed systems while remediation is scheduled and verified. Security teams should also consider reviewing relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Security teams should also check asset inventory for potentially affected systems and prioritize remediation based on risk and exposure. Security teams should also consider implementing compensating controls for exposed systems while remediation is scheduled and verified. Security teams should also review and update configurations for trustedOrigins validation to prevent potential open redirect attacks. Security teams should also consider tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented. Security teams should also consider reviewing relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should also consider planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should also consider confirming whether affected product deployments exist in managed environments and assigning an owner for follow-up. Security teams should also consider checking relevant monitoring, detection, and logs for exposed assets that ne

Technical summary

The better-auth library versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic, allowing attackers to construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover. This vulnerability affects absolute URLs and wildcard domains, and defenders should review configurations for trustedOrigins validation.

Defensive priority

Organizations using better-auth versions before 1.1.20 should prioritize upgrading to a patched version to prevent potential account takeover attacks.

Recommended defensive actions

• Upgrade to better-auth version 1.1.20 or later
• Review and update configurations for trustedOrigins validation
• Monitor for potential open redirect attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record indicates a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains in better-auth versions before 1.1.20. However, details about the vulnerability's impact and affected configurations are limited. To verify, defenders should review the official advisory and assess their product deployments for potential exposure.

Official resources