CVE-2025-27143 Details
Description
Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs, it incorrectly allows scheme-less URLs. This results in the browser interpreting the URL as a fully qualified URL, leading to unintended redirection. An attacker can exploit this flaw by crafting a malicious verification link and tricking users into clicking it. Upon successful email verification, the user will be automatically redirected to the attacker's website, which can be used for phishing, malware distribution, or stealing sensitive authentication tokens. This CVE is a bypass of the fix for GHSA-8jhw-6pjj-8723/CVE-2024-56734. Version 1.1.21 contains an updated patch.
A high-severity open redirect vulnerability has been identified in the Better Auth library for TypeScript, affecting versions prior to 1.1.21. The issue arises from improper validation of the callbackURL parameter in the email verification endpoint and other endpoints that accept callback URLs. While the server blocks fully qualified URLs, it mistakenly allows scheme-less URLs, which are interpreted as fully qualified by the browser. This flaw can be exploited by crafting a malicious verification link that redirects users to an attacker's website after email verification, potentially leading to phishing, malware distribution, or theft of sensitive authentication tokens.
Users can upgrade to Better Auth version 1.1.21 or later, which includes a patch for this vulnerability by enforcing proper validation of the callbackURL parameter. Alternatively, hooks can be used to pre-check URLs in the auth instance before upgrading.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 25, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| better-auth better auth | < 1.1.21 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 28, 2025 | Initial Analysis | [email protected] |
| Feb 24, 2025 | New CVE Received | [email protected] |