Vulnerability · Published Aug 2, 2026 · Assigned by VulnCheck

CVE-2025-71399Better Auth before 1.4.5 Path Normalization Bypass via rou3

High 8.6

In plain English

A high-severity improper input validation in better-auth from better-auth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.5%top 55.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	better-auth	1.4.5	GHSA-x732-6j76-qmhm

Affected products (as reported)

Vendor	Product	Versions
better-auth	better-auth	0 – before 1.4.5

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

References

GitHub Security Advisory (GHSA-x732-6j76-qmhm) vendor-advisory
Patch Commit patch
VulnCheck Advisory: Better Auth before 1.4.4 Path Normalization Bypass via rou3 third-party-advisory