Skip to content

chore(monorepo): update pnpm.catalog.default better-auth to v1.4.5 [security] #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(monorepo): update pnpm.catalog.default better-auth to v1.4.5 [security] #4

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link

@renovate renovate bot commented Sep 14, 2025 •
edited
Loading

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
better-auth (source) 1.2.5 -> 1.4.5 age confidence

GitHub Vulnerability Alerts

CVE-2025-53535

Summary

An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback.

Details

In the matchesPattern function, url.startsWith( can be deceived with a url that starts with one of the trustedOrigins.

		const matchesPattern = (url: string, pattern: string): boolean => {
			if (url.startsWith("/")) {
				return false;
			}
			if (pattern.includes("*")) {
				return wildcardMatch(pattern)(getHost(url));
			}
			return url.startsWith(pattern);
		};

Open Redirect PoCs

export const auth = betterAuth({
	baseURL: 'http://localhost:3000',
	trustedOrigins: [
		"http://trusted.com"
	],
	emailAndPassword: {
		...
	},
})

/reset-password/:token

image
image 1

/verify-email

image
image

/delete-user/callback

image
image

/magic-link/verify

image
image

/oauth-proxy-callback

image
image

Impact

Untrusted open redirects in various routes.

CVE-2025-61928

Summary

A critical authentication bypass was identified in the API key creation and update endpoints. An attacker could create or modify API keys for arbitrary users by supplying a victim’s user ID in the request body. Due to a flaw in how the authenticated user was derived, the endpoints could treat attacker-controlled input as an authenticated user object under certain conditions.

Details

The vulnerability originated from fallback logic used when determining the current user. When no session was present, the handler incorrectly allowed request-body data to populate the user context used for authorization decisions. Because server-side validation only executed when authentication was required, privileged fields were not properly protected. As a result, the API accepted unauthenticated requests that targeted other users.

This same pattern affected both the API key creation and update routes.

Impact

Unauthenticated attackers could generate or modify API keys belonging to any user. This granted full authenticated access as the targeted user and, depending on the user’s privileges, could lead to account compromise, access to sensitive data, or broader application takeover.

GHSA-569q-mpph-wgww

Summary

Affected versions of Better Auth allow an external request to configure baseURL when it isn’t defined through any other means. This can be abused to poison the router’s base path, causing all routes to return 404 for all users.

This issue is only exploitable when baseURL is not explicitly configured (e.g., BETTER_AUTH_URL is missing) and the attacker is able to make the very first request to the server after startup. In properly configured environments or typical managed hosting platforms, this fallback behavior cannot be reached.

Details

A combination of X-Forwarded-Host and X-Forwarded-Proto is implicitly trusted. This allows the first request to configure baseURL whenever it is not explicitly configured.

Here's the code that reads the headers:

headers

Here's the call to getBaseURL(), the result is assigned to ctx.baseURL.

write

Here's the router receiving the poisoned basePath:

router

X-Forwarded-Host and X-Forwarded-Proto can be used to modify the pathname of a parsed URL object which forms baseURL. basePath is then derived from the pathname of baseURL. Once the router basePath is poisoned it fails to match & route incoming requests.

Repro

Start a better-auth server with no baseURL configuration.

Send the following request as the first request to the server:

curl -i --location 'https://example.com/api/auth/ok' \
--header 'X-Forwarded-Proto: some:' \
--header 'X-Forwarded-Host: junk'

The better-auth API check endpoint returns 404.

Now send a regular request without the X-Forwarded-Proto and X-Forwarded-Host headers.

curl -i --location 'https://example.com/api/auth/ok'

The better-auth API check endpoint still returns 404.

Example result

attack

We have modified the basePath for the router until the server is restarted. An attacker can repeatedly send these attack requests aiming to persistently exploit the vulnerability.

GHSA-x732-6j76-qmhm

Summary

An issue in the underlying router library rou3 can cause /path and //path to be treated as identical routes. If your environment does not normalize incoming URLs (e.g., by collapsing multiple slashes), this can allow bypasses of disabledPaths and path-based rate limits.

Details

Better Auth uses better-call, which internally relies on rou3 for routing. Affected versions of rou3 normalize paths by removing empty segments. As a result:

  • /sign-in/email
  • //sign-in/email
  • ///sign-in/email

…all resolve to the same route.

Some production setups automatically collapse multiple slashes. This includes:

In these environments and other configurations where //path reach Better Auth as /path, the issue does not apply.

Fix

Updating rou3 to the latest version resolves the issue:

Better Auth recommends:

  1. Upgrading to Better Auth v1.4.5 or later, which includes the updated rou3.
  2. Ensuring the proxy normalizes URLs.
  3. If project maintainers cannot upgrade yet, they can protect their app by normalizing url before it reaches better-auth handler. See example below:
const req = new Request(...) // this would be the actual request object
const url = new URL(req.url);
const normalizedPath = url.pathname.replace(/\/+/g, "/");

if (url.pathname !== normalizedPath) {
  url.pathname = normalizedPath;
  // Update the raw request pathname
  Object.defineProperty(req, "url", {
    value: url.toString(),
    writable: true,
    configurable: true,
  });
}

Impact

  • Bypass disabledPaths
  • Bypass path-based rate limits

The impact of bypassing disabled paths could vary based on a project's configuration.

Release Notes

better-auth/better-auth (better-auth)

v1.4.5

Compare Source

v1.4.4

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.3

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.2

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub

v1.4.0

Compare Source

   🚀 Features
   🐞 Bug Fixes

Configuration

📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Sep 14, 2025
@renovate renovate bot requested review from a team and sullivanpj as code owners September 14, 2025 23:57
@renovate renovate bot added the dependencies Pull requests that update a dependency file label Sep 14, 2025
@renovate renovate bot enabled auto-merge (squash) September 14, 2025 23:57
github-actions[bot]
github-actions bot reviewed Sep 14, 2025
View reviewed changes
Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hello, I'm 🤖 Stormie-Bot! The Storm team sincerely appreciates your effort/interest in contributing to this project. A Storm developer will review this change and get back to you ASAP. Please feel free to reach out to the Storm team ([email protected]) if you have any questions/comments.

@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 3a30269 to 82911dd Compare September 26, 2025 20:16
@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 82911dd to 80dd773 Compare October 9, 2025 15:45
@renovate renovate bot changed the title chore(monorepo): update pnpm.catalog.default better-auth to v1.2.10 [security] chore(monorepo): update pnpm.catalog.default better-auth to v1.3.26 [security] Oct 9, 2025
@socket-security
Copy link

socket-security bot commented Oct 9, 2025 •
edited
Loading

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 80dd773 to 300f21a Compare October 23, 2025 07:12
@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch 2 times, most recently from ebac748 to 3de6e7e Compare November 19, 2025 03:46
@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 3de6e7e to 499c695 Compare December 1, 2025 23:46
@renovate renovate bot changed the title chore(monorepo): update pnpm.catalog.default better-auth to v1.3.26 [security] chore(monorepo): update pnpm.catalog.default better-auth to v1.4.2 [security] Dec 1, 2025
@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 499c695 to 530c741 Compare December 3, 2025 20:07
@renovate renovate bot force-pushed the renovate/npm-better-auth-vulnerability branch from 530c741 to 36dff43 Compare December 19, 2025 00:01
@renovate renovate bot requested a review from a team as a code owner December 19, 2025 00:01
@renovate renovate bot changed the title chore(monorepo): update pnpm.catalog.default better-auth to v1.4.2 [security] chore(monorepo): update pnpm.catalog.default better-auth to v1.4.5 [security] Dec 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments

@sullivanpj sullivanpj Awaiting requested review from sullivanpj sullivanpj is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant