{"id":"CVE-2025-71403","aliases":["EUVD-2025-210582","GHSA-g2jv-pgqw-qxhv","GHSA-vp58-j275-797x"],"status":"published","title":"better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass","description":"better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00342,"percentile":0.27939,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2025-02-24T20:49:50Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"npm","package":"better-auth","fixed_in":["1.1.21"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"better-auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.1.20"},{"fixed":"1.1.21"}]}]},{"source":"osv","ecosystem":"npm","package":"better-auth","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.21"}]}]}],"products":[{"vendor":"better-auth","product":"better-auth"}],"references":[{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x","tags":["vendor-advisory","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71403","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g2jv-pgqw-qxhv"},{"url":"https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80","tags":["web"]},{"url":"https://github.com/better-auth/better-auth/blob/ddebd0358d74376ea64541512d0167dd4377f182/packages/better-auth/src/api/middlewares/origin-check.ts#L53","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vp58-j275-797x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71403.json","tags":["advisory"]},{"url":"https://github.com/better-auth/better-auth","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-71403","title":"better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass","description":"better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.","status":"published","published":"2026-08-01T12:22:18.102Z","modified":"2026-08-03T18:18:54.122Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:32:42.751171Z"}],"euvd":[{"id":"EUVD-2025-210582","description":"better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.","status":"published","published":"2026-08-01T12:22:18Z","modified":"2026-08-03T18:18:54Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:24.01774Z"}],"ghsa":[{"id":"GHSA-g2jv-pgqw-qxhv","title":"better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation...","description":"better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.","status":"published","published":"2026-08-01T15:30:23Z","modified":"2026-08-01T15:30:29Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"high"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:10:01.548476Z"},{"id":"GHSA-vp58-j275-797x","title":"Better Auth allows bypassing the trustedOrigins Protection which leads to ATO","description":"### Summary\n\nA bypass was discovered in the trustedOrigins validation logic—affecting both absolute URL entries and wildcard domain patterns. This flaw allows an attacker to construct a malicious callbackURL that passes origin checks and triggers an open redirect.\n\nBecause redirect endpoints include sensitive tokens (such as password-reset tokens), this vulnerability can enable one-click account takeover if a victim clicks a crafted link.","status":"published","published":"2025-02-24T20:49:50Z","modified":"2025-12-09T16:27:08Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:39:12.222121Z"}],"nvd":[{"id":"CVE-2025-71403","description":"better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.","status":"published","published":"2026-08-01T13:16:56.607Z","modified":"2026-10-06T22:10:00.247Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:12:03.20248Z"}],"osv":[{"id":"CVE-2025-71403","title":"better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass","description":"better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.","status":"published","published":"2026-08-01T12:22:18.102Z","modified":"2026-10-28T02:30:42.561081094Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"GHSA-vp58-j275-797x","title":"Better Auth allows bypassing the trustedOrigins Protection which leads to ATO","description":"### Summary\n\nA bypass was discovered in the trustedOrigins validation logic—affecting both absolute URL entries and wildcard domain patterns. This flaw allows an attacker to construct a malicious callbackURL that passes origin checks and triggers an open redirect.\n\nBecause redirect endpoints include sensitive tokens (such as password-reset tokens), this vulnerability can enable one-click account takeover if a victim clicks a crafted link.","status":"published","published":"2025-02-24T20:49:50Z","modified":"2026-08-02T03:56:47.282836883Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","level":"high"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:57.348035Z"}]}}