Unrated severityNVD Advisory· Published Aug 1, 2026· Updated Aug 3, 2026
better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
CVE-2025-71403
Description
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
Affected products
2- Range: <1.1.20
- Range: <1.1.20
Patches
Vulnerability mechanics
References
2- github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797xmitrevendor-advisory
- www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypassmitrethird-party-advisory
News mentions
0No linked articles in our index yet.