CVE-2025-71399: Better Auth Path Bypass Vulnerability

CVE-2025-71399 Overview

CVE-2025-71399 is an input validation vulnerability [CWE-20] in Better Auth, an authentication library for Node.js applications. Better Auth depends on better-call, which uses the rou3 router library. The rou3 router normalizes paths by stripping empty segments, causing /path, //path, and ///path to resolve to the same route. Attackers exploit this behavior to bypass disabledPaths configuration entries and path-based rate limits by prefixing extra slashes to request URIs. Better Auth versions prior to 1.4.5 are affected. Deployments where an upstream proxy or platform collapses multiple slashes before the request reaches Better Auth are not exposed.

Critical Impact
Attackers can bypass authentication path restrictions and rate limiting by manipulating URL path separators, exposing endpoints intended to be disabled.

Affected Products

Better Auth versions prior to 1.4.5
better-call dependency using vulnerable rou3 router
Applications relying on Better Auth disabledPaths or path-based rate limiting without upstream URL normalization

Discovery Timeline

2026-08-02 - CVE-2025-71399 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2025-71399

Vulnerability Analysis

The vulnerability is an improper input validation flaw [CWE-20] in path routing. Better Auth uses disabledPaths and path-based rate-limit rules keyed to canonical route strings. The underlying rou3 router treats any sequence of consecutive slashes as a single delimiter, then discards empty segments during normalization. As a result, a request to //sign-in/email resolves to the same handler as /sign-in/email, but the string-based lookup for disabled paths and rate-limit keys does not match. The handler executes even when the operator has explicitly disabled the route.

The issue affects only server configurations where the request path reaches Better Auth unchanged. Reverse proxies such as nginx, or platforms that collapse duplicate slashes, neutralize the bypass before the framework sees the request.

Root Cause

The root cause is inconsistent path canonicalization between the routing layer and the policy layer. The rou3 router silently normalizes paths for dispatch, while Better Auth performs exact string comparisons against user-supplied path values in its configuration. This mismatch allows the same logical route to be reached through multiple raw string representations, only one of which is checked against security policy.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to a Better Auth endpoint with one or more additional leading or embedded slashes. The framework routes the request to the intended handler while skipping the disabledPaths check and the rate-limit counter increment. This enables enumeration of disabled endpoints, brute force against credential endpoints, and abuse of throttled APIs. Details are documented in the GitHub Security Advisory GHSA-x732-6j76-qmhm and the VulnCheck Advisory.

Detection Methods for CVE-2025-71399

Indicators of Compromise

HTTP access logs containing request paths with consecutive slashes targeting Better Auth routes, for example //sign-in/email or ///verify-email.
Successful responses from endpoints listed in the application's disabledPaths configuration.
Rate-limit counters remaining static while authentication attempts against protected routes continue to succeed.

Detection Strategies

Inspect web server and application logs for URI paths matching the regex //+ and correlate with Better Auth route names.
Compare request volume against rate-limit metrics to identify counter bypass patterns.
Alert on authentication attempts hitting routes that should return 404 based on disabledPaths policy.

Monitoring Recommendations

Enable verbose HTTP logging at the edge to capture raw, unnormalized request paths for forensic review.
Monitor Better Auth version inventories across services and flag any instance below 1.4.5.
Track authentication anomalies such as sudden bursts of sign-in or password-reset requests bypassing established throttles.

How to Mitigate CVE-2025-71399

Immediate Actions Required

Upgrade Better Auth to version 1.4.5 or later, which bundles the fixed rou3 router.
Configure the upstream reverse proxy or CDN to collapse consecutive slashes before forwarding requests.
Audit disabledPaths and rate-limit configurations, then confirm each route rejects requests submitted with extra slashes.

Patch Information

The fix is included in Better Auth 1.4.5. The remediation commit is available at the GitHub Commit Update. Applications using better-call and rou3 directly should also upgrade to a version incorporating the router fix.

Workarounds

Deploy nginx with merge_slashes on; or an equivalent directive on other proxies to collapse repeated slashes.
Add middleware ahead of Better Auth that rewrites request paths using a regex replacement such as path.replace(/\/+/g, '/').
Enforce Web Application Firewall (WAF) rules that reject requests containing // sequences in the URI path.

bash

# nginx configuration example to collapse duplicate slashes
server {
    listen 443 ssl;
    server_name app.example.com;

    merge_slashes on;

    location /api/auth/ {
        proxy_pass http://better_auth_upstream;
        proxy_set_header Host $host;
    }
}