CVE-2025-71403: better-auth Auth Bypass Vulnerability

CVE-2025-71403 Overview

CVE-2025-71403 is an open redirect vulnerability in the better-auth authentication library affecting all versions before 1.1.20. The flaw resides in the trustedOrigins validation logic, which fails to correctly evaluate absolute URLs and wildcard domain patterns. Attackers can craft malicious callbackURL parameters that satisfy the origin check while redirecting victims to attacker-controlled hosts. This condition is classified under CWE-601: URL Redirection to Untrusted Site. Threat actors leverage the redirect to exfiltrate authentication tokens transmitted through URL fragments or query parameters, enabling account takeover.

Critical Impact
Successful exploitation permits theft of session tokens and OAuth artifacts, resulting in full account compromise of users who click a crafted authentication link.

Affected Products

better-auth versions prior to 1.1.20
Applications integrating better-auth with wildcard entries in trustedOrigins
Applications relying on callbackURL handling in sign-in and OAuth flows

Discovery Timeline

2026-08-01 - CVE-2025-71403 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2025-71403

Vulnerability Analysis

The vulnerability stems from flawed origin comparison inside better-auth's trustedOrigins validator. The library accepts both absolute URLs and wildcard domain patterns in the trusted list, but the matcher does not strictly normalize or anchor the comparison against the incoming callbackURL. An attacker can supply a URL whose structure passes the loose string match yet resolves to an untrusted external host at browser navigation time.

Because callbackURL is used post-authentication, the redirect happens with the user's session context in flight. Tokens returned in the URL, including OAuth authorization codes and session identifiers, are delivered to the attacker's origin through the Referer header or direct query propagation. The attacker then replays these credentials against the legitimate application.

Root Cause

The root cause is inadequate URL parsing and pattern matching in trustedOrigins evaluation. Wildcard entries such as *.example.com are matched with insufficient boundary enforcement, permitting hosts like evil-example.com or attacker.com/example.com to satisfy the check. Absolute URL entries suffer similar prefix or substring comparison flaws.

Attack Vector

Exploitation requires user interaction. The attacker distributes a phishing link pointing to the legitimate better-auth-protected endpoint with a manipulated callbackURL parameter. After the victim authenticates or if a valid session exists, the server issues a redirect to the attacker-controlled destination, leaking tokens embedded in the response URL. See the GitHub Security Advisory GHSA-vp58-j275-797x and the VulnCheck Advisory for reference details.

Detection Methods for CVE-2025-71403

Indicators of Compromise

Authentication logs showing callbackURL parameters pointing to hosts outside the application's canonical domain set.
HTTP 302 responses from better-auth endpoints containing Location headers to unexpected external origins.
Referer headers in downstream services referencing unknown domains following successful sign-in events.

Detection Strategies

Inspect web server and reverse proxy logs for callbackURL values containing encoded characters, @ symbols, or double-slash sequences intended to confuse URL parsing.
Alert on redirects issued by authentication endpoints where the target host is not enumerated in an allowlist maintained outside the application.
Correlate sign-in events with subsequent session activity originating from atypical geolocations or user agents within a short window.

Monitoring Recommendations

Enable verbose logging on the better-auth handler and forward events to a centralized SIEM for correlation.
Track the version of better-auth deployed across services and flag any instance below 1.1.20.
Baseline the distribution of callbackURL destinations and alert on statistical outliers.

How to Mitigate CVE-2025-71403

Immediate Actions Required

Upgrade better-auth to version 1.1.20 or later across all applications and dependencies.
Audit trustedOrigins configuration and remove overly broad wildcard entries such as *.com or bare domain suffixes.
Rotate active session tokens and OAuth secrets if suspicious redirect activity is present in logs.

Patch Information

The maintainers addressed the flaw in better-auth version 1.1.20 by tightening origin normalization and enforcing strict host boundary matching for wildcard patterns. Details are documented in the GitHub Security Advisory GHSA-vp58-j275-797x.

Workarounds

Replace wildcard entries in trustedOrigins with an explicit list of fully qualified domains until the upgrade is applied.
Validate the callbackURL parameter at the application layer against a server-maintained allowlist before passing it to better-auth.
Strip or reject requests where callbackURL contains encoded control characters, @, or protocol-relative prefixes.

bash

# Configuration example: pin better-auth to a fixed, patched version
npm install better-auth@^1.1.20

# Example: explicit trustedOrigins instead of wildcards
# auth.config.ts
# trustedOrigins: [
#   "https://app.example.com",
#   "https://admin.example.com"
# ]