Executive brief
Better Auth is a JavaScript authentication library used to manage user login and password reset flows. A flaw in the origin validation logic allows attackers to bypass security checks and redirect users to malicious sites, potentially stealing sensitive tokens used for password reset—enabling one-click account takeover if victims click a crafted link.
Technical details
The vulnerability is an open redirect (CWE-601) caused by improper validation of the trustedOrigins configuration in Better Auth. The origin-check middleware fails to properly validate both absolute URLs and wildcard domain patterns, allowing an attacker to craft a malicious callbackURL that passes origin checks yet redirects to an attacker-controlled destination. The flaw requires user interaction (victim must click the crafted link) and is network-accessible with no authentication required. Exploitation can lead to token theft and account takeover. The issue is patched in version 1.1.21 and affects all versions up to 1.1.20.
Affected products
- Better Auth better-auth <=1.1.20
Timeline
- 2025-02-24: disclosed
- 2025-02-24: patched: patched in version 1.1.21