Read the docs
TI-2024-37618 Aliases CVE-2024-56734GHSA-8jhw-6pjj-8723

Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

Priority LOW 35CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on email verification links generated by the library. The verify email callback endpoint accepts a `callbackURL` parameter. Unlike other verification methods, email verification only uses JWT to verify and redirect without proper validation of the target domain. The origin checker is bypassed in this scenario because it only checks for `POST` requests. An attacker can manipulate this parameter to redirect users to arbitrary URLs controlled by the attacker. Version 1.1.6 contains a patch for the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00387 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed better-auth (better-auth): 1.1.5better-auth (npm): 1.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
better-authbetter-authbefore 1.1.51.1.5Patch availableCNA
—better-auth (npm)before 1.1.61.1.6Patch availableGHSA-8jhw-6pjj-8723
  • better-auth Vendorbetter-auth Affected before 1.1.5 Fixed in 1.1.5 Patch available CNA
  • better-auth (npm) Vendor— Affected before 1.1.6 Fixed in 1.1.6 Patch available GHSA-8jhw-6pjj-8723

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*before 1.1.6Vulnerablebetter-auth
  • cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:* Versions before 1.1.6 Vulnerable ·better-auth

Remediation

  • Fix · CNA better-auth (better-auth) Fixed in 1.1.5
  • Fix · GHSA-8jhw-6pjj-8723 better-auth (npm) Fixed in 1.1.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-56734
  2. 2026-10-03 Alias added: GHSA-8jhw-6pjj-8723

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2025-20000 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter CVSS 4.0MEDIUM 6.9
  • TI-2026-38586 Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins CVSS 4.0CRITICAL 9.1
  • TI-2026-38587 Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration CVSS 3.1CRITICAL 9.6
  • TI-2026-38591 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking CVSS 3.1HIGH 8.1
  • TI-2026-38590 Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email CVSS 3.1HIGH 8.3
  • TI-2026-38592 Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption CVSS 4.0HIGH 7.6
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences