{"id":"GHSA-4vcf-q4xf-f48m","revision":"8a63e610eb594961adb1efff82df0704","records":[{"revision":"8a63e610eb594961adb1efff82df0704","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-4vcf-q4xf-f48m","aliases":["CVE-2025-71400"],"title":"Better Auth Passkey Plugin allows passkey deletion through IDOR","description":"# Summary\n\nAffected versions of the better-auth passkey plugin allow users with any valid session to delete arbitrary passkeys via their ID using `POST /passkey/delete-passkey`.\n\n# Details\n\n`ctx.body.id` is implicitly trusted and used in passkey deletion queries.\n\nbetter-auth applications configured with `useNumberId` may use auto incrementing IDs which makes it trivial to delete all passkeys via enumeration.","state":0,"publishedAt":"2025-11-25T21:42:53+00:00","modifiedAt":"2026-08-03T03:56:46.4494484+00:00","affected":[{"ecosystem":"npm","name":"@better-auth/passkey","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.4.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m","https://github.com/better-auth/better-auth/commit/06d68239e","https://github.com/better-auth/better-auth"],"sourceUrl":"https://github.com/advisories/GHSA-4vcf-q4xf-f48m","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4vcf-q4xf-f48m","identifiers":["GHSA-4vcf-q4xf-f48m","CVE-2025-71400"]},"retained":false,"historicalAffected":[]}],"coverage":[]}