GitHub Security Advisory (GHSA-vp58-j275-797x)Vendor advisory
https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x CVE-2025-71403
HIGH
better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
Record summary
CVE-2025-71403 has a selected CVSS score of 7.1 (high).
Description
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 3, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
better-authBrowse better-auth / better-authDefault status: unaffected | CVE List | Before 1.1.20 | affected |
| 1.1.20 | unaffected |
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-71403 VulnCheck Advisory: better-auth before 1.1.20 Open Redirect via trustedOrigins BypassThird-party advisory
https://www.vulncheck.com/advisories/better-auth-before-open-redirect-via-trustedorigins-bypass