CVE-2025-71403

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.1.20

Description A flaw exists in the trustedOrigins validation logic concerning absolute URLs and wildcard domain patterns. This allows an attacker to craft a malicious callbackURL parameter that bypasses origin checks, resulting in an open redirect. Since redirect endpoints may contain sensitive tokens, such as password-reset tokens, this can lead to one-click account takeover if a user clicks a malicious link.

Recommendations Update better-auth to version 1.1.20 or later.