Executive brief
The Better Auth passkey authentication plugin contains a critical authorization flaw that allows any authenticated user to delete passkeys belonging to other users. By simply guessing or enumerating passkey IDs, an attacker can disable all authentication credentials for other accounts, causing account lockout and service disruption. This is particularly severe for applications using auto-incrementing passkey IDs, which are trivial to enumerate. The flaw is fixed in version 1.4.0.
Technical details
The vulnerability is an insecure direct object reference (IDOR) in the passkey deletion handler. The POST /passkey/delete-passkey endpoint accepts a passkey ID from ctx.body.id without validating that the requesting user owns that passkey. The deletion query uses only the ID parameter, failing to filter results by the current user's ID. For applications configured with useNumberId (auto-incrementing IDs), attackers can trivially enumerate passkeys and delete all credentials. The fix (commit 06d6823) adds a userId filter to the deletion query, ensuring users can only delete their own passkeys. Attack requires a valid session but no additional user interaction. Patched in version 1.4.0.
Affected products
- Better Auth @better-auth/passkey < 1.4.0
Timeline
- 2025-11-25: disclosed: Advisory published on GitHub
- 2025-11-25: patched: Fix released in version 1.4.0