Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes
Priority MEDIUM 44CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.
Summary
Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00378 32nd percentileScored 2026-11-07
Fix Fixed better-auth (better-auth): 1.2.10better-auth (npm): 1.2.10
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| better-auth | better-auth | before 1.2.10 | 1.2.10 | Patch available | CNA |
| — | better-auth (npm) | before 1.2.10 | 1.2.10 | Patch available | GHSA-36rg-gfq2-3h56 |
- better-auth Vendorbetter-auth Affected before 1.2.10 Fixed in 1.2.10 Patch available CNA
- better-auth (npm) Vendor— Affected before 1.2.10 Fixed in 1.2.10 Patch available GHSA-36rg-gfq2-3h56
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:*:*:* | — | — | better-auth |
- cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:*:*:* Versions — — ·better-auth
Remediation
- Fix · CNA better-auth (better-auth) Fixed in 1.2.10
- Fix · GHSA-36rg-gfq2-3h56 better-auth (npm) Fixed in 1.2.10 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-53535
- 2026-10-03 Alias added: GHSA-36rg-gfq2-3h56
References
More better-auth vulnerabilities
- TI-2025-38277 Better Auth: Unauthenticated API key creation through api-key plugin CVSS 4.0CRITICAL 9.3
- TI-2026-47627 better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass CVSS 4.0HIGH 8.7
- TI-2025-20000 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter CVSS 4.0MEDIUM 6.9
- TI-2026-13066 better-auth better-icons scan_project_icons/sync_icon path traversal CVSS 4.0MEDIUM 4.8
- TI-2026-79320 OAuth state accepted as Magic Link token in Better Auth CVSS 3.1CRITICAL 9.1
- TI-2026-74552 Authentication bypass in Better Auth Magic Link verification CVSS 4.0CRITICAL 9.3
Sources
- CVE-2025-53535 · CVE Program
- CVE-2025-53535 · NVD
- FIRST EPSS
- GHSA-36rg-gfq2-3h56 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences