GitHub Security Advisory (GHSA-569q-mpph-wgww)Vendor advisory
https://github.com/better-auth/better-auth/security/advisories/GHSA-569q-mpph-wgww CVE-2025-71401
CRITICAL
better-auth before 1.4.2 basePath Modification DoS
Record summary
CVE-2025-71401 has a selected CVSS score of 9.3 (critical).
Description
better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 3, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
better-authBrowse better-auth / better-authDefault status: unaffected | CVE List | Before 1.4.2 | affected |
| 1.4.2 | unaffected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-71401 VulnCheck Advisory: better-auth before 1.4.1 basePath Modification DoSThird-party advisory
https://www.vulncheck.com/advisories/better-auth-before-basepath-modification-dos