{"id":"GHSA-vp58-j275-797x","revision":"3f44667d66e84edcbf732e4bd7a80ff6","records":[{"revision":"3f44667d66e84edcbf732e4bd7a80ff6","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-vp58-j275-797x","aliases":["CVE-2025-71403"],"title":"Better Auth allows bypassing the trustedOrigins Protection which leads to ATO","description":"### Summary\n\nA bypass was discovered in the trustedOrigins validation logic—affecting both absolute URL entries and wildcard domain patterns. This flaw allows an attacker to construct a malicious callbackURL that passes origin checks and triggers an open redirect.\n\nBecause redirect endpoints include sensitive tokens (such as password-reset tokens), this vulnerability can enable one-click account takeover if a victim clicks a crafted link.","state":0,"publishedAt":"2025-02-24T20:49:50+00:00","modifiedAt":"2026-08-02T03:56:47.2828369+00:00","affected":[{"ecosystem":"npm","name":"better-auth","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.21"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x","https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80","https://github.com/better-auth/better-auth","https://github.com/better-auth/better-auth/blob/ddebd0358d74376ea64541512d0167dd4377f182/packages/better-auth/src/api/middlewares/origin-check.ts#L53"],"sourceUrl":"https://github.com/advisories/GHSA-vp58-j275-797x","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vp58-j275-797x","identifiers":["GHSA-vp58-j275-797x","CVE-2025-71403"]},"retained":false,"historicalAffected":[]}],"coverage":[]}