Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

Vulnerability

Description

Better Auth, a TypeScript authentication library, contains an open redirect vulnerability in its email verification endpoint. The issue affects all versions prior to v1.1.6. The verify email callback endpoint accepts a callbackURL parameter, but unlike other verification methods, email verification only uses a JWT to verify and redirect without proper validation of the target domain. The origin checker is bypassed in this scenario because it only checks for POST requests, leaving the endpoint vulnerable to manipulation [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious email verification link that includes a callbackURL parameter pointing to an arbitrary external domain. When a user clicks the link, the library verifies the JWT and then redirects the user to the attacker-controlled URL. No authentication is required to trigger the redirect; the attacker only needs to generate a valid verification link (which may be possible if they can intercept or forge email verification requests) [1].

Impact

Successful exploitation allows an attacker to redirect users to malicious websites, potentially leading to phishing attacks, credential theft, or malware distribution. The open redirect can be used to bypass security controls that rely on domain validation, as the initial request appears to originate from a trusted source [1].

Mitigation

The vulnerability has been patched in Better Auth version 1.1.6. Users are strongly advised to upgrade to this version or later. No workarounds are mentioned in the advisory; upgrading is the recommended course of action [1].