CVE-2025-71400: better-auth passkey Auth Bypass Flaw

CVE-2025-71400 Overview

CVE-2025-71400 affects the better-auth passkey plugin in versions before 1.4.0. The vulnerability is an insecure direct object reference (IDOR) in the passkey deletion endpoint [CWE-639]. Any authenticated user can submit a crafted request containing another user's passkey ID and delete that credential. The endpoint fails to verify that the target passkey belongs to the requesting session before performing the deletion.

Critical Impact
Authenticated attackers can remove arbitrary users' WebAuthn credentials, enabling denial of authentication and forcing victims onto weaker fallback authentication methods.

Affected Products

better-auth passkey plugin versions prior to 1.4.0
Applications integrating the better-auth passkey module for WebAuthn authentication
Downstream projects depending on vulnerable better-auth releases

Discovery Timeline

2026-08-02 - CVE-2025-71400 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2025-71400

Vulnerability Analysis

The better-auth passkey plugin exposes a delete-passkey endpoint that accepts a passkey identifier as input. The endpoint authenticates the caller but does not authorize the operation against the resource owner. As a result, any user with a valid session can supply an arbitrary passkey ID and delete the credential associated with it. This is a textbook insecure direct object reference, tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Removal of a victim's passkey degrades their authentication posture. Users relying exclusively on WebAuthn lose access until re-enrollment. Users with fallback methods are pushed to less phishing-resistant factors such as passwords or one-time codes. Successful exploitation impacts integrity of the authentication state while confidentiality is not directly affected.

Root Cause

The root cause is a missing ownership check in the passkey deletion handler. The handler trusts the caller-supplied id parameter and issues the delete against the backing store without matching the record's user ID against the session subject. An authenticated request context is treated as sufficient authorization for a per-resource action.

Attack Vector

Exploitation requires an authenticated session and network access to the application. An attacker enumerates or guesses passkey identifiers and issues delete requests to the vulnerable endpoint. Because passkey IDs are the only qualifying parameter, an attacker who obtains or predicts a target ID can delete that credential in a single request. No user interaction is required from the victim. Refer to the GitHub Security Advisory GHSA-4vcf-q4xf-f48m and the VulnCheck Advisory for technical detail.

Detection Methods for CVE-2025-71400

Indicators of Compromise

Unexpected passkey deletion events in authentication audit logs for users who did not initiate the action.
Requests to the delete-passkey endpoint where the passkey record's owner does not match the authenticated session subject.
Spikes in passkey deletion requests originating from a single session or IP address.
User complaints about missing registered authenticators or forced fallback authentication.

Detection Strategies

Instrument the delete-passkey handler to log the session user ID alongside the passkey owner ID and alert on mismatches.
Correlate deletion events with subsequent password or recovery-flow logins from different geographies or devices.
Baseline typical per-user passkey management activity and flag deviations such as bulk deletions.

Monitoring Recommendations

Forward authentication and account-management logs to a centralized analytics platform for retention and correlation.
Alert on any delete-passkey response returning success where session subject and record owner differ.
Monitor better-auth dependency versions across services and flag any instance below 1.4.0.

How to Mitigate CVE-2025-71400

Immediate Actions Required

Upgrade the better-auth passkey plugin to version 1.4.0 or later across all environments.
Audit passkey deletion history for the past several months and notify users whose credentials were removed without their action.
Rotate or re-enroll passkeys for any account showing suspicious deletion activity.

Patch Information

The maintainers addressed the issue in better-auth passkey 1.4.0 by enforcing ownership validation in the deletion endpoint. Details are published in the GitHub Security Advisory GHSA-4vcf-q4xf-f48m. Update the dependency in package.json and redeploy affected services.

Workarounds

If immediate upgrade is not possible, wrap the delete-passkey route with a middleware that fetches the passkey record and compares its user ID to the session subject before proceeding.
Rate-limit and log all deletion requests to reduce enumeration risk and increase detection fidelity.
Restrict passkey management endpoints behind additional step-up authentication such as re-verification of an existing passkey.

bash

# Update better-auth to a patched version
npm install better-auth@^1.4.0
npm audit