Vulnerability · Published Jul 7, 2025 · Assigned by GitHub_M

CVE-2025-53535Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes

Low 2.1

In plain English

A low-severity open redirect in better-auth from better-auth. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.4%top 68.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	better-auth	1.2.10	GHSA-36rg-gfq2-3h56

Affected products (as reported)

Vendor	Product	Versions
better-auth	better-auth	< 1.2.10

Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

https://github.com/better-auth/better-auth/security/advisories/GHSA-36rg-gfq2-3h56 x_refsource_CONFIRM