Executive brief
better-auth is an npm authentication library used to manage user login and authorization in web applications. A vulnerability allows an attacker to make a specially crafted request immediately after server startup to poison the router's base path configuration, causing all application routes to return 404 errors and rendering the service unavailable to all users. This issue only affects deployments where the base URL is not explicitly configured and the application hasn't yet handled a legitimate request.
Technical details
This vulnerability is a denial-of-service flaw caused by improper configuration initialization in the better-auth router. The root cause is the library's reliance on the first HTTP request to set the baseURL when the BETTER_AUTH_URL environment variable is not defined. An unauthenticated, network-reachable attacker can exploit a race condition by sending a malicious request immediately after application startup, before legitimate configuration is applied. This poisons the router's internal base path state, causing all subsequent routing attempts to fail with 404 responses. The vulnerability requires the vulnerable configuration scenario (no explicit baseURL set and not on managed hosting platforms that pre-configure URLs). The fix is available in version 1.4.2, which likely implements immediate base path initialization or environment-based configuration defaults.
Affected products
- better-auth better-auth < 1.4.2
Timeline
- 2026-08-02: disclosed
- 2026-08-02: patched: Version 1.4.2 released
- 2026-09-01: other: Advisory withdrawn as duplicate of GHSA-569q-mpph-wgww
References
- https://api.github.com/users/antonisloukis
- https://github.com/antonisloukis
- https://api.github.com/users/antonisloukis/gists%7B/gist_id%7D
- https://api.github.com/users/antonisloukis/repos
- https://avatars.githubusercontent.com/u/301263012?v=4
- https://api.github.com/users/antonisloukis/events%7B/privacy%7D