Is CVE-2025-61928 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-61928 being exploited in the wild.

How severe is CVE-2025-61928?

Low severity, with a CVSS score of 3.1, published 9 October 2025.

Which products and versions are affected?

better-auth (npm) SEMVER:introduced=0,fixed=1.3.26.

Is there a fix for CVE-2025-61928?

Yes. better-auth (npm): upgrade to 1.3.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-61928 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-61928?

Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61928: Better Auth unauthenticated API key creation in api-key plugin

CVE-2025-61928 · Severity: low · CVSS 3.1 · Published 2025-10-09

Better Auth is an open-source authentication library used to handle user login, registration, and API key management in web applications. A critical flaw in the API key plugin allows attackers to create or modify API keys for any user without authentication, effectively granting them complete account access and potentially exposing sensitive data or enabling account takeover.

Technologies: better-auth (npm). Vendors: npm.

Quick answers

Is CVE-2025-61928 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-61928 being exploited in the wild.
How severe is CVE-2025-61928?: Low severity, with a CVSS score of 3.1, published 9 October 2025.
Which products and versions are affected?: better-auth (npm) SEMVER:introduced=0,fixed=1.3.26.
Is there a fix for CVE-2025-61928?: Yes. better-auth (npm): upgrade to 1.3.26 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61928 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-61928?: Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

better-auth (npm): upgrade to 1.3.26 or later
```
npm install better-auth@1.3.26
```

Technical details

The vulnerability is an authentication bypass (CWE-285/CWE-306) in the API key creation and update endpoints. The root cause is fallback logic that incorrectly uses request-body data to populate the user context when no session is present, bypassing proper authorization checks. An unauthenticated attacker can supply an arbitrary user ID in the request body to generate or modify API keys for any target user. The flaw affects both API key creation and update routes and requires only network access (no authentication or user interaction). This grants the attacker full authenticated access under the compromised user's privileges, potentially enabling data breach or application compromise. The issue is fixed in version 1.3.26.

Affected products

Better Auth better-auth before 1.3.26

Identifiers

CVE-2025-61928
GHSA-99h5-pjcv-gr6v

Timeline

2025-10-09: disclosed
2025-10-09: patched: Fixed in version 1.3.26

References

https://github.com/better-auth/better-auth/security/advisories/GHSA-99h5-pjcv-gr6v

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.