mx-admin icon indicating copy to clipboard operation
mx-admin copied to clipboard
verified publisher icon mx-space

fix(deps): update dependency better-auth to v1.4.5 [security]

Open renovate[bot] opened this issue 11 months ago • 1 comments

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
better-auth (source) 1.1.10 -> 1.4.5 age confidence

GitHub Vulnerability Alerts

GHSA-9x4v-xfq5-m8x5

Summary

The better-auth /api/auth/error page was vulnerable to HTML injection, resulting in a reflected cross-site scripting (XSS) vulnerability.

Details

The value of error URL parameter was reflected as HTML on the error page: https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81

Impact

An attacker who exploited this vulnerability by coercing a user to visit a specially-crafted URL could execute arbitrary JavaScript in the context of the user's browser.

CVE-2025-27143

Summary

The application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs (e.g., https://evil.com), it incorrectly allows scheme-less URLs (e.g., //malicious-site.com). This results in the browser interpreting the URL as https://malicious-site.com, leading to unintended redirection.

bypass for : https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723

Affected Versions

All versions prior to 1.1.19

Details

The application’s email verification endpoint (/auth/verify-email) accepts a callbackURL parameter intended to redirect users after successful email verification. While the server correctly blocks fully qualified external URLs (e.g., https://evil.com), it improperly allows scheme-less URLs (e.g., //malicious-site.com). This issue occurs because browsers interpret //malicious-site.com as https://malicious-site.com, leading to an open redirect vulnerability.

An attacker can exploit this flaw by crafting a malicious verification link and tricking users into clicking it. Upon successful email verification, the user will be automatically redirected to the attacker's website, which can be used for phishing, malware distribution, or stealing sensitive authentication tokens.

Impact

Phishing & Credential Theft – Attackers can redirect users to a fake login page, tricking them into entering sensitive credentials, which can then be stolen.

Session Hijacking & Token Theft – If used in OAuth flows, an attacker could redirect authentication tokens to their own domain, leading to account takeover.

GHSA-vp58-j275-797x

Summary

A bypass was discovered in the trustedOrigins validation logic—affecting both absolute URL entries and wildcard domain patterns. This flaw allows an attacker to construct a malicious callbackURL that passes origin checks and triggers an open redirect.

Because redirect endpoints include sensitive tokens (such as password-reset tokens), this vulnerability can enable one-click account takeover if a victim clicks a crafted link.

CVE-2025-53535

Summary

An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback.

Details

In the matchesPattern function, url.startsWith( can be deceived with a url that starts with one of the trustedOrigins.

		const matchesPattern = (url: string, pattern: string): boolean => {
			if (url.startsWith("/")) {
				return false;
			}
			if (pattern.includes("*")) {
				return wildcardMatch(pattern)(getHost(url));
			}
			return url.startsWith(pattern);
		};

Open Redirect PoCs

export const auth = betterAuth({
	baseURL: 'http://localhost:3000',
	trustedOrigins: [
		"http://trusted.com"
	],
	emailAndPassword: {
		...
	},
})

/reset-password/:token

image
image 1

/verify-email

image
image

/delete-user/callback

image
image

/magic-link/verify

image
image

/oauth-proxy-callback

image
image

Impact

Untrusted open redirects in various routes.

CVE-2025-61928

Summary

A critical authentication bypass was identified in the API key creation and update endpoints. An attacker could create or modify API keys for arbitrary users by supplying a victim’s user ID in the request body. Due to a flaw in how the authenticated user was derived, the endpoints could treat attacker-controlled input as an authenticated user object under certain conditions.

Details

The vulnerability originated from fallback logic used when determining the current user. When no session was present, the handler incorrectly allowed request-body data to populate the user context used for authorization decisions. Because server-side validation only executed when authentication was required, privileged fields were not properly protected. As a result, the API accepted unauthenticated requests that targeted other users.

This same pattern affected both the API key creation and update routes.

Impact

Unauthenticated attackers could generate or modify API keys belonging to any user. This granted full authenticated access as the targeted user and, depending on the user’s privileges, could lead to account compromise, access to sensitive data, or broader application takeover.

GHSA-569q-mpph-wgww

Summary

Affected versions of Better Auth allow an external request to configure baseURL when it isn’t defined through any other means. This can be abused to poison the router’s base path, causing all routes to return 404 for all users.

This issue is only exploitable when baseURL is not explicitly configured (e.g., BETTER_AUTH_URL is missing) and the attacker is able to make the very first request to the server after startup. In properly configured environments or typical managed hosting platforms, this fallback behavior cannot be reached.

Details

A combination of X-Forwarded-Host and X-Forwarded-Proto is implicitly trusted. This allows the first request to configure baseURL whenever it is not explicitly configured.

Here's the code that reads the headers:

headers

Here's the call to getBaseURL(), the result is assigned to ctx.baseURL.

write

Here's the router receiving the poisoned basePath:

router

X-Forwarded-Host and X-Forwarded-Proto can be used to modify the pathname of a parsed URL object which forms baseURL. basePath is then derived from the pathname of baseURL. Once the router basePath is poisoned it fails to match & route incoming requests.

Repro

Start a better-auth server with no baseURL configuration.

Send the following request as the first request to the server:

curl -i --location 'https://example.com/api/auth/ok' \
--header 'X-Forwarded-Proto: some:' \
--header 'X-Forwarded-Host: junk'

The better-auth API check endpoint returns 404.

Now send a regular request without the X-Forwarded-Proto and X-Forwarded-Host headers.

curl -i --location 'https://example.com/api/auth/ok'

The better-auth API check endpoint still returns 404.

Example result

attack

We have modified the basePath for the router until the server is restarted. An attacker can repeatedly send these attack requests aiming to persistently exploit the vulnerability.

GHSA-x732-6j76-qmhm

Summary

An issue in the underlying router library rou3 can cause /path and //path to be treated as identical routes. If your environment does not normalize incoming URLs (e.g., by collapsing multiple slashes), this can allow bypasses of disabledPaths and path-based rate limits.

Details

Better Auth uses better-call, which internally relies on rou3 for routing. Affected versions of rou3 normalize paths by removing empty segments. As a result:

  • /sign-in/email
  • //sign-in/email
  • ///sign-in/email

…all resolve to the same route.

Some production setups automatically collapse multiple slashes. This includes:

  • Vercel with Nextjs (default)
  • Cloudflare - when normalize to urls origin is enabled (https://developers.cloudflare.com/rules/normalization/settings/#normalize-urls-to-origin)

In these environments and other configurations where //path reach Better Auth as /path, the issue does not apply.

Fix

Updating rou3 to the latest version resolves the issue:

Better Auth recommends:

  1. Upgrading to Better Auth v1.4.5 or later, which includes the updated rou3.
  2. Ensuring the proxy normalizes URLs.
  3. If project maintainers cannot upgrade yet, they can protect their app by normalizing url before it reaches better-auth handler. See example below:
const req = new Request(...) // this would be the actual request object
const url = new URL(req.url);
const normalizedPath = url.pathname.replace(/\/+/g, "/");

if (url.pathname !== normalizedPath) {
  url.pathname = normalizedPath;
  // Update the raw request pathname
  Object.defineProperty(req, "url", {
    value: url.toString(),
    writable: true,
    configurable: true,
  });
}

Impact

  • Bypass disabledPaths
  • Bypass path-based rate limits

The impact of bypassing disabled paths could vary based on a project's configuration.

Release Notes

better-auth/better-auth (better-auth)

v1.4.5

Compare Source

v1.4.4

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.3

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.2

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • [ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] avatar Feb 06 '25 01:02 renovate[bot]

SafeDep Report Summary

Green Malicious Packages Badge Green Vulnerable Packages Badge Green Risky License Badge

Package Details
Package Malware Vulnerability Risky License Report
icon @better-auth/core @ 1.4.5
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon @better-auth/telemetry @ 1.4.5
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon @better-auth/utils @ 0.3.0
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon @better-fetch/fetch @ 1.1.18
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon @noble/ciphers @ 2.1.1
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon @noble/hashes @ 2.0.1
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon @standard-schema/spec @ 1.1.0
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon better-auth @ 1.4.5
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon better-call @ 1.1.4
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon jose @ 6.1.3
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon kysely @ 0.28.9
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon ms @ 4.0.0-nightly.202508271359
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon nanostores @ 1.1.0
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon rou3 @ 0.7.12
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon set-cookie-parser @ 2.7.2
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon zod @ 4.2.1
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗

This report is generated by SafeDep Github App

safedep[bot] avatar Sep 25 '25 14:09 safedep[bot]