Executive brief
Better Auth, an authentication library for TypeScript applications, contains a vulnerability that could allow attackers to redirect users to malicious websites. By tricking a user into clicking a specially crafted link related to password resets or email verification, an attacker can bypass security checks and send the user to an untrusted external site. This is often used in phishing campaigns to steal credentials by making a malicious site appear legitimate.
Technical details
An open redirect vulnerability (CWE-601) exists in the 'originCheck' middleware of Better Auth due to an insecure string comparison in the 'matchesPattern' function. The function uses 'url.startsWith(pattern)' to validate redirect targets against 'trustedOrigins'; however, an attacker can provide a URL that starts with a trusted domain but continues into an attacker-controlled domain (e.g., 'http://trusted.com.attacker.com'). This affects several critical authentication routes including /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, and /oauth-proxy-callback. An attacker can exploit this by sending a crafted link to a victim, which, upon interaction, redirects the victim from the legitimate application to a malicious site. The issue is resolved in version 1.2.10.
Affected products
- better-auth better-auth <= 1.2.9
Timeline
- 2025-07-06: disclosed: Advisory published on GitHub
- 2025-07-07: advisory: CVE-2025-53535 assigned
- 2025-07-07: patched: Fixed in version 1.2.10