CVE-2025-71400

Name of the Vulnerable Software and Affected Versions better-auth passkey versions prior to 1.4.0

Description An insecure direct object reference occurs in the passkey deletion endpoint, allowing authenticated users to delete arbitrary passkeys. Attackers with valid sessions can send crafted requests to the '/passkey/delete-passkey' endpoint by enumerating passkey IDs. The issue stems from the ctx.body.id variable being implicitly trusted during deletion queries. Applications configured with useNumberId are particularly susceptible as they may use auto-incrementing IDs, simplifying the process of deleting all passkeys through enumeration.

Recommendations Update better-auth passkey to version 1.4.0 or later.