{"id":"CVE-2025-53535","aliases":["EUVD-2025-20283","GHSA-36rg-gfq2-3h56"],"status":"published","title":"Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes","description":"Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00378,"percentile":0.32055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2025-07-07T17:15:52Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"npm","package":"better-auth","fixed_in":["1.2.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"better-auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.9"},{"fixed":"1.2.10"}]}]},{"source":"osv","ecosystem":"npm","package":"better-auth","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.10"}]}]}],"products":[{"vendor":"better-auth","product":"better-auth"}],"references":[{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-36rg-gfq2-3h56","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53535","tags":["advisory"]},{"url":"https://github.com/better-auth/better-auth/commit/9801d1be53d9da04686b94c6286c53ec97496740","tags":["web"]},{"url":"https://github.com/advisories/GHSA-36rg-gfq2-3h56"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53535.json","tags":["advisory"]},{"url":"https://github.com/better-auth/better-auth","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-53535","title":"Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes","description":"Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.","status":"published","published":"2025-07-07T17:15:52.027Z","modified":"2025-07-07T17:48:36.223Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"low","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:32:49.180768Z"}],"euvd":[{"id":"EUVD-2025-20283","description":"Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.","status":"published","published":"2025-07-07T17:15:52Z","modified":"2025-07-07T17:48:36Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"}],"updated_at":"2026-11-02T20:32:13.402869Z"}],"ghsa":[{"id":"GHSA-36rg-gfq2-3h56","title":"Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes","description":"### Summary\n\nAn open redirect has been found in the `originCheck` middleware function, which affects the following routes: `/verify-email`, `/reset-password/:token`, `/delete-user/callback`, `/magic-link/verify`, `/oauth-proxy-callback`.\n\n### Details\n\nIn the `matchesPattern` function, `url.startsWith(` can be deceived with a `url` that starts with one of the `trustedOrigins`.\n\n```jsx\n\t\tconst matchesPattern = (url: string, pattern: string): boolean =\u003e {\n\t\t\tif (url.startsWith(\"/\")) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tif (pattern.includes(\"*\")) {\n\t\t\t\treturn wildcardMatch(pattern)(getHost(url));\n\t\t\t}\n\t\t\treturn url.startsWith(pattern);\n\t\t};\n```\n\n### Open Redirect PoCs\n\n```jsx\nexport const auth = betterAuth({\n\tbaseURL: 'http://localhost:3000',\n\ttrustedOrigins: [\n\t\t\"http://trusted.com\"\n\t],\n\temailAndPassword: {\n\t\t...\n\t},\n})\n```\n\n#### `/reset-password/:token`\n\n\u003cimg width=\"481\" alt=\"image\" src=\"https://github.com/user-attachments/assets/46e7871a-1dad-4375-af94-0446e29aaab6\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"518\" alt=\"image 1\" src=\"https://github.com/user-attachments/assets/83abfb53-6fc9-4d1f-918d-9b4ce093c808\" /\u003e\n\n#### `/verify-email`\n\n\u003cimg width=\"549\" alt=\"image\" src=\"https://github.com/user-attachments/assets/7dd424b7-42a4-4616-aa73-fcc2e3eeb309\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"436\" alt=\"image\" src=\"https://github.com/user-attachments/assets/54f11636-0a3e-4e83-9a09-57c5e8ba98cd\" /\u003e\n\n#### `/delete-user/callback`\n\n\u003cimg width=\"545\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2ff1b217-d069-48fb-81c1-f8c8792d34a4\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"492\" alt=\"image\" src=\"https://github.com/user-attachments/assets/71df11db-9d38-4f34-abe1-add9d60b3486\" /\u003e\n\n#### `/magic-link/verify`\n\n\u003cimg width=\"379\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6b6b6a8a-59b6-4a65-9df3-57d5b2f6eb0f\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"413\" alt=\"image\" src=\"https://github.com/user-attachments/assets/82a5c9c6-2ea0-44eb-af48-40732657b59e\" /\u003e\n\n#### `/oauth-proxy-callback`\n\n\u003cimg width=\"548\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d8d2ee51-e9fd-4337-bec3-a70afd1ceacb\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"544\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f097d406-b965-4f85-b124-9b0ef1cc2689\" /\u003e\n\n### Impact\n\nUntrusted open redirects in various routes.","status":"published","published":"2025-07-07T22:13:14Z","modified":"2025-07-07T22:13:16Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:38:48.783737Z"}],"nvd":[{"id":"CVE-2025-53535","description":"Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.","status":"published","published":"2025-07-07T18:15:28.81Z","modified":"2026-06-17T09:38:24.233Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:11:16.997062Z"}],"osv":[{"id":"CVE-2025-53535","title":"Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes","description":"Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.","status":"published","published":"2025-07-07T17:15:52.027Z","modified":"2026-10-28T02:30:40.700495271Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"GHSA-36rg-gfq2-3h56","title":"Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes","description":"### Summary\n\nAn open redirect has been found in the `originCheck` middleware function, which affects the following routes: `/verify-email`, `/reset-password/:token`, `/delete-user/callback`, `/magic-link/verify`, `/oauth-proxy-callback`.\n\n### Details\n\nIn the `matchesPattern` function, `url.startsWith(` can be deceived with a `url` that starts with one of the `trustedOrigins`.\n\n```jsx\n\t\tconst matchesPattern = (url: string, pattern: string): boolean =\u003e {\n\t\t\tif (url.startsWith(\"/\")) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tif (pattern.includes(\"*\")) {\n\t\t\t\treturn wildcardMatch(pattern)(getHost(url));\n\t\t\t}\n\t\t\treturn url.startsWith(pattern);\n\t\t};\n```\n\n### Open Redirect PoCs\n\n```jsx\nexport const auth = betterAuth({\n\tbaseURL: 'http://localhost:3000',\n\ttrustedOrigins: [\n\t\t\"http://trusted.com\"\n\t],\n\temailAndPassword: {\n\t\t...\n\t},\n})\n```\n\n#### `/reset-password/:token`\n\n\u003cimg width=\"481\" alt=\"image\" src=\"https://github.com/user-attachments/assets/46e7871a-1dad-4375-af94-0446e29aaab6\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"518\" alt=\"image 1\" src=\"https://github.com/user-attachments/assets/83abfb53-6fc9-4d1f-918d-9b4ce093c808\" /\u003e\n\n#### `/verify-email`\n\n\u003cimg width=\"549\" alt=\"image\" src=\"https://github.com/user-attachments/assets/7dd424b7-42a4-4616-aa73-fcc2e3eeb309\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"436\" alt=\"image\" src=\"https://github.com/user-attachments/assets/54f11636-0a3e-4e83-9a09-57c5e8ba98cd\" /\u003e\n\n#### `/delete-user/callback`\n\n\u003cimg width=\"545\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2ff1b217-d069-48fb-81c1-f8c8792d34a4\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"492\" alt=\"image\" src=\"https://github.com/user-attachments/assets/71df11db-9d38-4f34-abe1-add9d60b3486\" /\u003e\n\n#### `/magic-link/verify`\n\n\u003cimg width=\"379\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6b6b6a8a-59b6-4a65-9df3-57d5b2f6eb0f\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"413\" alt=\"image\" src=\"https://github.com/user-attachments/assets/82a5c9c6-2ea0-44eb-af48-40732657b59e\" /\u003e\n\n#### `/oauth-proxy-callback`\n\n\u003cimg width=\"548\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d8d2ee51-e9fd-4337-bec3-a70afd1ceacb\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"544\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f097d406-b965-4f85-b124-9b0ef1cc2689\" /\u003e\n\n### Impact\n\nUntrusted open redirects in various routes.","status":"published","published":"2025-07-07T22:13:14Z","modified":"2025-07-07T22:59:37.760604Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}