Executive brief
better-call is a routing library used to handle HTTP requests in web applications. A path validation flaw allows attackers to craft URLs that appear to request static assets (like images or CSS) to CDNs, but actually return sensitive data like user sessions and personal information. When a CDN caches these responses, they may be served to other users, leading to unauthorized access and data exposure.
Technical details
The vulnerability is a cache deception (CWE-524) caused by insufficient path sanitization in the request processing logic. The library splits incoming request paths using config.basePath but fails to properly validate remaining path components, allowing attackers to craft requests like /api/auth/get-session/api/auth/image.png (when basePath=/api/auth) that bypass CDN cache exclusion rules for static assets while returning sensitive authenticated data. The flaw is in the processRequest function which uses a naive split() operation on the pathname. An attacker can send specially crafted requests over the network without authentication to poison the CDN cache. The vulnerability was fixed in version 1.0.12 with proper duplicate base path handling in the router.
Affected products
- better-auth better-call < 1.0.12
Timeline
- 2025-07-11: disclosed
- 2025-07-11: patched: Fixed in version 1.0.12