Tag
#Better Auth
newsHIGH 8.6
CVE-2025-71399: Path Normalization Bypass in Better Auth
A vulnerability in Better Auth versions prior to 1.4.5 allows attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. This issue has a CVSS score of 8.6 and is classified as HIGH severity.
blogHIGH 7.6
Understanding the OAuth Refresh-Token Rotation Vulnerability in Better Auth
This educational analysis covers a critical vulnerability in the Better Auth library, specifically in its OAuth refresh-token rotation mechanism. The vulnerability, identified as CVE-2026-53517, allows an attacker to fork a refresh-token family from a single parent token, leading to indefinite access. We will delve into the root cause, attack surface, exploitation mechanics, real-world impact, and defensive strategies.