Skip to content

chore(deps): update dependency better-auth to v1.4.2 [security] #2468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update dependency better-auth to v1.4.2 [security] #2468

wants to merge 1 commit into from
+84 −216

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 9, 2025 •
edited
Loading

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
better-auth (source) 1.3.7 -> 1.4.2 age confidence

GitHub Vulnerability Alerts

CVE-2025-61928

Summary

Unauthenticated attackers can create or modify API keys for any user by passing that user's id in the request body to the api/auth/api-key/create route.

Details

The vulnerability exists in the authentication logic at when checking for user authentication then derives the user as session?.user ?? (authRequired ? null : { id: ctx.body.userId }). When no session exists but userId is present in the request body, authRequired becomes false and the user object is set to the attacker-controlled ID. Server-only field validation only executes when authRequired is true (lines 280-295), allowing attackers to set privileged fields. No additional authentication occurs before the database operation, so the malicious payload is accepted. The same pattern exists in the update endpoint.

PoC

curl -X POST http://localhost:3000/api/auth/api-key/create \
   -H 'Content-Type: application/json' \
   -d '{
         "userId": "victim-user-id",
         "name": "zeropath"
       }'

Response contains the new API key whose userId matches the victim, confirming the bypass.

Impact

This is a critical authentication bypass enabling full an unauthenticated attacker can generate an API key for any user and immediately gain complete authenticated access. This allows the attacker to perform any action as the victim user using the api key, potentially compromise the user data and the application depending on the victim's privileges.

This issue was found by ZeroPath.

GHSA-569q-mpph-wgww

Summary

Affected versions of Better Auth allow an external request to configure baseURL when it isn’t defined through any other means. This can be abused to poison the router’s base path, causing all routes to return 404 for all users.

This issue is only exploitable when baseURL is not explicitly configured (e.g., BETTER_AUTH_URL is missing) and the attacker is able to make the very first request to the server after startup. In properly configured environments or typical managed hosting platforms, this fallback behavior cannot be reached.

Details

A combination of X-Forwarded-Host and X-Forwarded-Proto is implicitly trusted. This allows the first request to configure baseURL whenever it is not explicitly configured.

Here's the code that reads the headers:

headers

Here's the call to getBaseURL(), the result is assigned to ctx.baseURL.

write

Here's the router receiving the poisoned basePath:

router

X-Forwarded-Host and X-Forwarded-Proto can be used to modify the pathname of a parsed URL object which forms baseURL. basePath is then derived from the pathname of baseURL. Once the router basePath is poisoned it fails to match & route incoming requests.

Repro

Start a better-auth server with no baseURL configuration.

Send the following request as the first request to the server:

curl -i --location 'https://example.com/api/auth/ok' \
--header 'X-Forwarded-Proto: some:' \
--header 'X-Forwarded-Host: junk'

The better-auth API check endpoint returns 404.

Now send a regular request without the X-Forwarded-Proto and X-Forwarded-Host headers.

curl -i --location 'https://example.com/api/auth/ok'

The better-auth API check endpoint still returns 404.

Example result

attack

We have modified the basePath for the router until the server is restarted. An attacker can repeatedly send these attack requests aiming to persistently exploit the vulnerability.

Release Notes

better-auth/better-auth (better-auth)

v1.4.2

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@safedep
Copy link

safedep bot commented Oct 9, 2025 •
edited
Loading

SafeDep Report Summary

Green Malicious Packages Badge Green Vulnerable Packages Badge Green Risky License Badge

Package Details
Package Malware Vulnerability Risky License Report
icon @better-auth/core @ 1.4.2
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon @better-auth/telemetry @ 1.4.2
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon @better-auth/utils @ 0.3.0
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon @noble/ciphers @ 2.0.1
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon @noble/hashes @ 2.0.1
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon better-auth @ 1.4.2
packages/compiled/package.json pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon better-call @ 1.1.0
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon jose @ 6.1.3
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon nanostores @ 1.1.0
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon set-cookie-parser @ 2.7.2
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗

This report is generated by SafeDep Github App

@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 3e50cf5 to d3815b9 Compare October 21, 2025 23:38
@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch 5 times, most recently from 00ffbe4 to bc63554 Compare November 14, 2025 11:45
@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch 10 times, most recently from 8828c3a to fa29f9e Compare November 24, 2025 11:02
@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch 3 times, most recently from cb31ab0 to ece9b35 Compare December 2, 2025 01:00
@renovate renovate bot changed the title chore(deps): update dependency better-auth to v1.3.26 [security] chore(deps): update dependency better-auth to v1.4.2 [security] Dec 2, 2025
@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch 3 times, most recently from 2c8ed80 to 933cec0 Compare December 3, 2025 14:09
@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 933cec0 to 3ab77fc Compare December 3, 2025 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant