Goksan

Better Auth utilizes the better-call library, which depends on the rou3 router. In affected versions of rou3, paths are normalized by removing empty segments, causing paths such as `/path`, `//path`, and `///path` to resolve to the same route. This behavior allows attackers to bypass the `disabledPaths` configuration and path-based rate limits by including extra slashes in the URL path. This issue does not affect deployments where the proxy or platform automatically normalizes URLs by collapsing multiple slashes.

An issue exists where an external request can configure the `baseURL` when it is not explicitly defined (for example, when `BETTER AUTH URL` is unset). This occurs because the system implicitly trusts the `X-Forwarded-Host` and `X-Forwarded-Proto` headers. An attacker who can send the first request to the server after startup can use these headers to poison the router's base path. This results in a denial of service where all subsequent routes return a 404 error for all users until the server is restarted. This issue is not reachable on typical managed hosting platforms or when `baseURL` is explicitly configured.

An insecure direct object reference occurs in the passkey deletion endpoint, allowing authenticated users to delete arbitrary passkeys. Attackers with valid sessions can send crafted requests to the '/passkey/delete-passkey' endpoint by enumerating passkey IDs. The issue stems from the `ctx.body.id` variable being implicitly trusted during deletion queries. Applications configured with `useNumberId` are particularly susceptible as they may use auto-incrementing IDs, simplifying the process of deleting all passkeys through enumeration.