CVE-2024-56734: Better Auth Open Redirect Vulnerability

CVE-2024-56734 Overview

CVE-2024-56734 is an open redirect vulnerability [CWE-601] in Better Auth, a TypeScript authentication library. The flaw resides in the email verification callback endpoint, which accepts a callbackURL parameter without validating the destination domain. All versions of Better Auth prior to v1.1.6 are affected. The origin checker middleware only enforced validation on POST requests, allowing GET-based email verification flows to bypass the check entirely. Attackers can craft verification links that redirect users to arbitrary attacker-controlled URLs after clicking through legitimate email verification workflows.

Critical Impact
Attackers can weaponize legitimate email verification links to redirect authenticated users to phishing or malware sites, undermining trust in the authentication flow.

Affected Products

Better Auth versions prior to v1.1.6
Node.js applications using better-auth for authentication
Deployments relying on email verification callbacks

Discovery Timeline

2024-12-30 - CVE-2024-56734 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56734

Vulnerability Analysis

Better Auth exposes an email verification callback endpoint that consumes a callbackURL query parameter. After validating the verification JSON Web Token (JWT), the endpoint issues an HTTP redirect to the supplied URL. The library ships an originCheckMiddleware intended to constrain callbackURL values against a trustedOrigins allowlist. However, the middleware short-circuits on any request that is not a POST. Email verification links are opened via GET requests from mail clients, which skips origin validation entirely. The JWT validation confirms the token but performs no check on the redirect target, so any attacker-controlled URL is honored.

Root Cause

The root cause is an incomplete input validation control in packages/better-auth/src/api/middlewares/origin-check.ts. The middleware returned early when ctx.request?.method !== "POST", leaving GET handlers such as the email verification callback without protection against untrusted redirect targets.

Attack Vector

An attacker crafts a request to the email verification endpoint appending a malicious callbackURL (for example, an attacker-controlled phishing domain). The victim receives or is tricked into clicking the crafted link. After the JWT succeeds, the server issues a 302 redirect to the attacker's URL. Because the redirect originates from a trusted authentication domain, users and secondary security controls may treat it as legitimate.

typescript

// Patch from commit deb3d73aea90d0468d92723f4511542b593e522f
// packages/better-auth/src/api/middlewares/origin-check.ts
 import { createAuthMiddleware } from "../call";
 import { wildcardMatch } from "../../utils/wildcard";
 import { getHost } from "../../utils/url";
+import type { GenericEndpointContext } from "src/types";

 /**
  * A middleware to validate callbackURL and origin against
  * trustedOrigins.
  */
 export const originCheckMiddleware = createAuthMiddleware(async (ctx) => {
-	if (ctx.request?.method !== "POST") {
-		return;
-	}
 	const { body, query, context } = ctx;
 	const originHeader =
 		ctx.headers?.get("origin") || ctx.headers?.get("referer") || "";

Source: Better Auth commit deb3d73. The fix removes the POST-only guard so the origin checker runs for all HTTP methods, including GET requests used by verification callbacks.

Detection Methods for CVE-2024-56734

Indicators of Compromise

Access log entries to /api/auth/verify-email (or the application's configured verification path) containing callbackURL values pointing to external domains not present in the trustedOrigins allowlist.
302 responses from the verification endpoint with Location headers referencing untrusted hosts.
Spikes in email verification requests originating from unusual source IPs or user agents.

Detection Strategies

Inventory all applications using better-auth and identify versions below v1.1.6 through software composition analysis of package.json and package-lock.json.
Instrument the verification endpoint to log the resolved redirect destination and alert on any host outside trustedOrigins.
Correlate verification-flow redirects with downstream user reports of phishing or credential compromise.

Monitoring Recommendations

Monitor outbound redirects from authentication endpoints and flag hostnames that do not match the application's own domains.
Add web application firewall (WAF) rules that inspect callbackURL parameters on GET requests to authentication routes.
Review email delivery telemetry for verification messages containing anomalous callbackURL query strings.

How to Mitigate CVE-2024-56734

Immediate Actions Required

Upgrade better-auth to v1.1.6 or later across every service that consumes the library.
Audit the trustedOrigins configuration to confirm it contains only intended domains and subdomains.
Invalidate outstanding email verification tokens issued before the upgrade if abuse is suspected.

Patch Information

The fix is delivered in Better Auth v1.1.6 through commit deb3d73aea90d0468d92723f4511542b593e522f. The patch removes the method check inside originCheckMiddleware, ensuring the trustedOrigins allowlist is enforced on GET requests including the email verification callback. See the GitHub Security Advisory GHSA-8jhw-6pjj-8723 for the vendor's advisory.

Workarounds

If immediate upgrade is not possible, place a reverse proxy or WAF rule in front of the verification endpoint to reject requests whose callbackURL host does not match the application's own domains.
Wrap the verification handler with a custom middleware that explicitly validates callbackURL against a hardcoded allowlist before delegating to Better Auth.
Strip or ignore untrusted callbackURL values by rewriting them to a fixed post-verification landing page.

bash

# Upgrade Better Auth to the patched release
npm install better-auth@^1.1.6

# Or with pnpm / yarn
pnpm add better-auth@^1.1.6
yarn add better-auth@^1.1.6

# Verify the installed version
npm ls better-auth