Executive brief
better-auth is an authentication library for web applications. When the base URL is not explicitly configured, an attacker can make the initial request to a newly started server to set a malicious base path, causing the application to return 404 errors for all subsequent requests and denying service to legitimate users. This vulnerability only affects self-hosted deployments without proper baseURL configuration.
Technical details
The vulnerability is a resource allocation issue (CWE-770) where better-auth allows external requests to configure the baseURL when it is not otherwise defined. The attack requires two preconditions: (1) baseURL is not explicitly configured via environment variables (e.g., BETTER_AUTH_URL is unset), and (2) the attacker can make the very first HTTP request to the server immediately after startup. When these conditions are met, the attacker's request can poison the router's base path configuration, causing all routes to return 404 errors and creating a denial of service. The vulnerability is not reachable when baseURL is explicitly configured through environment variables or on managed hosting platforms that provide base URL configuration. The fix is to upgrade to better-auth version 1.4.2 or later.
Affected products
- better-auth better-auth < 1.4.2
Timeline
- 2025-11-27: disclosed: GHSA-569q-mpph-wgww published
- 2025-11: patched: Version 1.4.2 released with fix
- 2026-08-02: other: Duplicate advisory GHSA-3q45-2fh7-66cj published
- 2026-09-01: other: Duplicate advisory withdrawn