CVE-2025-53535
CVE-2025-53535 · Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.
CVSS 2.1 · Low · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
better-auth
- Versions
- < 1.2.10: Affected
No fix published
better-auth npm
- Affected ranges
- SEMVER: < 1.2.10
Update to 1.2.10