High severity · published Aug 1, 2026
CVE-2025-71403
better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
better-auth · better-auth
before 1.1.20 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-71403
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-71403
github.com
https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x
www.vulncheck.com
https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass
More from better-auth
9.6
CVE-2026-53513
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
9.3
CVE-2025-61928
Better Auth: Unauthenticated API key creation through api-key plugin
9.1
CVE-2026-114607
better-auth: OAuth state can be used as a Magic Link to sign in as another user
9.1
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
9.1
CVE-2026-53512
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins