Security Advisory

CVE-2025-71403

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-01 12:22:18

Last updated 2026-08-01 12:22:18

Assigner VulnCheck

CVSS score not scored

State PUBLISHED

Description

better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.

← Browse all CVEs View on cve.org ↗