Executive brief
Better Auth is a JavaScript authentication library used by developers to manage user login, registration, and email verification flows. An open redirect vulnerability in the email verification endpoint allows attackers to craft malicious verification links that redirect users to attacker-controlled websites, enabling phishing attacks, credential harvesting, and damage to application trust.
Technical details
The vulnerability is an open redirect (CWE-601) in the /verify-email GET endpoint of Better Auth. The endpoint accepts a callbackURL parameter that is redirected to after successful email verification, but unlike other verification flows, the domain validation logic is bypassed because the origin check only applies to POST requests. An attacker can craft a verification URL with an arbitrary callbackURL parameter (e.g., https://example.com/auth/verify-email?token=...&callbackURL=https://malicious-site.com) to redirect authenticated users to untrusted domains without validation. This is a GET-based redirect vulnerability affecting all versions prior to v1.1.6, which has been patched with strict domain validation.
Affected products
- Better Auth Better Auth prior to 1.1.6
Timeline
- 2024-12-30: disclosed
- 2024-12-30: patched: v1.1.6 released with domain validation fix