Executive Summary
A vulnerability in Better Auth, a popular authentication library, allows attackers to bypass security configurations by manipulating URL paths. This issue, tracked as CVE-2025-71399, has a CVSS score of 8.6 and is considered HIGH severity. Affected versions of Better Auth are prior to 1.4.5.
Technical Analysis
The vulnerability exists in the rou3 router library used by Better Auth. Specifically, rou3 normalizes paths by removing empty segments, causing URLs like /path, //path, and ///path to resolve to the same route. In Better Auth versions prior to 1.4.5, this behavior allows attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The root cause is the improper handling of URL paths, which enables an attacker to access restricted routes.
How It Gets Exploited
An attacker can exploit this vulnerability by sending a request with extra slashes in the URL path to a Better Auth instance running a version prior to 1.4.5. For example, if a user has configured disabledPaths to block /admin, an attacker could send a request to //admin or ///admin, which would bypass the restriction due to the improper normalization of paths. This could allow an attacker to access restricted areas of the application or evade rate limiting.
Impact Assessment
Better Auth versions prior to 1.4.5 are affected by this vulnerability. An attacker could leverage this issue to bypass security configurations, potentially leading to unauthorized access or elevated privileges. The CVSS score for this vulnerability is 8.6, indicating a high level of severity.
Recommended Actions
To mitigate this vulnerability, update Better Auth to version 1.4.5 or later. Additionally, consider implementing additional security measures such as URL normalization at the proxy or platform level to prevent similar bypasses in the future.
Sources
- National Vulnerability Database (NVD)
- Vulncheck