GHSA-vp58-j275-797xPublished
better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2025-71403 · Microsoft / collected KEV context
cve-program · CVE-2025-71403
- https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x
- https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass
euvd · EUVD-2025-210582
- https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x
- https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass
nvd · CVE-2025-71403
- https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x
- https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass
osv · GHSA-vp58-j275-797x
- https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x
- https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80
- https://github.com/better-auth/better-auth
- https://github.com/better-auth/better-auth/blob/ddebd0358d74376ea64541512d0167dd4377f182/packages/better-auth/src/api/middlewares/origin-check.ts#L53
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.