CVE-2025-27143: Better Auth Open Redirect Vulnerability

CVE-2025-27143 Overview

CVE-2025-27143 is an open redirect vulnerability [CWE-601] in Better Auth, a TypeScript authentication and authorization library. The flaw exists in versions prior to 1.1.21 and affects the callbackURL parameter in the email verification endpoint and other endpoints accepting callback URLs. While the server blocks fully qualified URLs, it fails to reject scheme-less URLs such as //attacker.com. Browsers interpret these as fully qualified URLs, causing redirection to attacker-controlled domains. This issue is a bypass of the earlier fix for GHSA-8jhw-6pjj-8723 (CVE-2024-56734).

Critical Impact
Attackers can craft malicious verification links that redirect authenticated users to attacker-controlled sites, enabling phishing, malware delivery, and theft of authentication tokens.

Affected Products

Better Auth (npm package better-auth) versions prior to 1.1.21
Node.js applications using Better Auth for email verification workflows
Applications relying on the callbackURL parameter in Better Auth endpoints

Discovery Timeline

2025-02-24 - CVE-2025-27143 published to NVD
2025-02-24 - GitHub Security Advisory GHSA-hjpm-7mrm-26w8 published; version 1.1.21 released with patch
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27143

Vulnerability Analysis

The vulnerability resides in the origin validation logic within packages/better-auth/src/api/middlewares/origin-check.ts. Better Auth validates callback URLs by rejecting fully qualified URLs while permitting relative paths that start with /. The original validation logic checked that a URL began with / and did not contain : (to block schemes like https:). This check failed to account for protocol-relative URLs beginning with //.

When a browser receives a redirect to //attacker.com/path, it treats the value as a protocol-relative URL and resolves it against the current scheme. The user is then sent to the attacker's domain rather than the intended relative path within the application. This makes the malicious link appear legitimate because it originates from the trusted Better Auth email verification flow.

Root Cause

The root cause is incomplete input validation in the isTrustedOrigin check. The original guard treated any string starting with / and lacking a : character as safe. Protocol-relative URLs bypass this heuristic because they start with / and contain no colon.

Attack Vector

An attacker crafts a verification or callback link containing callbackURL=//attacker.com. The victim clicks the link, completes email verification, and is redirected to the attacker's domain. The attacker can host a phishing clone, deliver malware, or capture authentication artifacts passed via the redirect.

typescript

// Patch 1: packages/better-auth/src/api/middlewares/origin-check.ts
// fix(origin-check): prevent URLs with double slashes from being trusted
const isTrustedOrigin = trustedOrigins.some(
    (origin) =>
        matchesPattern(url, origin) ||
-       (url?.startsWith("/") && label !== "origin" && !url.includes(":")),
+       (url?.startsWith("/") &&
+           label !== "origin" &&
+           !url.includes(":") &&
+           !url.includes("//")),
);
if (!isTrustedOrigin) {
    ctx.context.logger.error(`Invalid ${label}: ${url}`);
}

// Patch 2: Hardened to a strict regex allowlist
-       !url.includes(":") &&
-       !url.includes("//")),
+       /^\/(?![\\/%])[\w\-./]*$/.test(url)),

Source: better-auth commit 24659ae and better-auth commit b381cac

Detection Methods for CVE-2025-27143

Indicators of Compromise

HTTP requests to Better Auth endpoints containing callbackURL parameters that begin with // or contain encoded variants like %2F%2F and /\.
Email verification links in outbound mail logs with callback URLs pointing to unfamiliar external hosts.
Redirects from application domains to untrusted external domains immediately after /verify-email or similar callbacks.

Detection Strategies

Inspect web server and reverse proxy logs for callbackURL query parameters matching the pattern ^(//|/\\|/%2[fF]|/%5[cC]).
Deploy Web Application Firewall (WAF) rules that decode URL parameters and block protocol-relative values in authentication callback parameters.
Review the better-auth package version in package.json and package-lock.json across your Node.js deployments to identify hosts running versions prior to 1.1.21.

Monitoring Recommendations

Alert on 3xx responses from Better Auth endpoints where the Location header points to a domain outside the configured trustedOrigins list.
Track anomalous spikes in email verification link clicks that terminate on external domains.
Add software composition analysis (SCA) checks to CI pipelines to flag vulnerable better-auth versions.

How to Mitigate CVE-2025-27143

Immediate Actions Required

Upgrade better-auth to version 1.1.21 or later across all Node.js services.
Audit application code for direct use of the callbackURL parameter and enforce server-side allowlists for redirect targets.
Rotate any authentication tokens that may have been exposed through malicious redirects prior to patching.

Patch Information

The fix is delivered in Better Auth 1.1.21. The initial patch in commit 24659ae blocked URLs containing //. A follow-up in commit b381cac replaced the deny-list approach with a strict allowlist regex /^\/(?![\\/%])[\w\-./]*$/ that only permits well-formed relative paths. See the GitHub Release v1.1.21 and the GHSA-hjpm-7mrm-26w8 advisory.

Workarounds

If immediate upgrade is not possible, add reverse-proxy or middleware rules that reject callbackURL values not matching a strict relative-path pattern.
Constrain the trustedOrigins configuration to explicit hostnames and remove any wildcard entries.
Sanitize callback URL inputs by rejecting values containing //, /\, %2f%2f, or %5c sequences before passing them to Better Auth.

bash

# Upgrade Better Auth to the patched release
npm install better-auth@^1.1.21

# Verify installed version
npm ls better-auth

# Example Express middleware to enforce relative-path callback URLs
# node -e "..." pattern for quick pre-patch mitigation
app.use((req, res, next) => {
  const cb = req.query.callbackURL;
  if (typeof cb === 'string' && !/^\/(?![\\/%])[\w\-./]*$/.test(cb)) {
    return res.status(400).send('Invalid callbackURL');
  }
  next();
});