Vulnerability-Lookup

GHSA-36RG-GFQ2-3H56

Vulnerability from github – Published: 2025-07-07 22:13 – Updated: 2025-07-07 22:13

Summary

Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes

Details

Summary

An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback.

Details

In the matchesPattern function, url.startsWith( can be deceived with a url that starts with one of the trustedOrigins.

        const matchesPattern = (url: string, pattern: string): boolean => {
            if (url.startsWith("/")) {
                return false;
            }
            if (pattern.includes("*")) {
                return wildcardMatch(pattern)(getHost(url));
            }
            return url.startsWith(pattern);
        };

Open Redirect PoCs

export const auth = betterAuth({
    baseURL: 'http://localhost:3000',
    trustedOrigins: [
        "http://trusted.com"
    ],
    emailAndPassword: {
        ...
    },
})

`/reset-password/:token`

`/verify-email`

`/delete-user/callback`

`/magic-link/verify`

`/oauth-proxy-callback`

Impact

Untrusted open redirects in various routes.

Severity

2.1 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.2.9"
      },
      "package": {
        "ecosystem": "npm",
        "name": "better-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-53535"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-07T22:13:14Z",
    "nvd_published_at": "2025-07-07T18:15:28Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nAn open redirect has been found in the `originCheck` middleware function, which affects the following routes: `/verify-email`, `/reset-password/:token`, `/delete-user/callback`, `/magic-link/verify`, `/oauth-proxy-callback`.\n\n### Details\n\nIn the `matchesPattern` function, `url.startsWith(` can be deceived with a `url` that starts with one of the `trustedOrigins`.\n\n```jsx\n\t\tconst matchesPattern = (url: string, pattern: string): boolean =\u003e {\n\t\t\tif (url.startsWith(\"/\")) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t\tif (pattern.includes(\"*\")) {\n\t\t\t\treturn wildcardMatch(pattern)(getHost(url));\n\t\t\t}\n\t\t\treturn url.startsWith(pattern);\n\t\t};\n```\n\n### Open Redirect PoCs\n\n```jsx\nexport const auth = betterAuth({\n\tbaseURL: \u0027http://localhost:3000\u0027,\n\ttrustedOrigins: [\n\t\t\"http://trusted.com\"\n\t],\n\temailAndPassword: {\n\t\t...\n\t},\n})\n```\n\n#### `/reset-password/:token`\n\n\u003cimg width=\"481\" alt=\"image\" src=\"https://github.com/user-attachments/assets/46e7871a-1dad-4375-af94-0446e29aaab6\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"518\" alt=\"image 1\" src=\"https://github.com/user-attachments/assets/83abfb53-6fc9-4d1f-918d-9b4ce093c808\" /\u003e\n\n#### `/verify-email`\n\n\u003cimg width=\"549\" alt=\"image\" src=\"https://github.com/user-attachments/assets/7dd424b7-42a4-4616-aa73-fcc2e3eeb309\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"436\" alt=\"image\" src=\"https://github.com/user-attachments/assets/54f11636-0a3e-4e83-9a09-57c5e8ba98cd\" /\u003e\n\n#### `/delete-user/callback`\n\n\u003cimg width=\"545\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2ff1b217-d069-48fb-81c1-f8c8792d34a4\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"492\" alt=\"image\" src=\"https://github.com/user-attachments/assets/71df11db-9d38-4f34-abe1-add9d60b3486\" /\u003e\n\n#### `/magic-link/verify`\n\n\u003cimg width=\"379\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6b6b6a8a-59b6-4a65-9df3-57d5b2f6eb0f\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"413\" alt=\"image\" src=\"https://github.com/user-attachments/assets/82a5c9c6-2ea0-44eb-af48-40732657b59e\" /\u003e\n\n#### `/oauth-proxy-callback`\n\n\u003cimg width=\"548\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d8d2ee51-e9fd-4337-bec3-a70afd1ceacb\" /\u003e\n\u003cbr/\u003e\n\u003cimg width=\"544\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f097d406-b965-4f85-b124-9b0ef1cc2689\" /\u003e\n\n### Impact\n\nUntrusted open redirects in various routes.",
  "id": "GHSA-36rg-gfq2-3h56",
  "modified": "2025-07-07T22:13:14Z",
  "published": "2025-07-07T22:13:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-36rg-gfq2-3h56"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53535"
    },
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/commit/9801d1be53d9da04686b94c6286c53ec97496740"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/better-auth/better-auth"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes"
}

CVE-2025-53535 (GCVE-0-2025-53535)

Vulnerability from cvelistv5 – Published: 2025-07-07 17:15 – Updated: 2025-07-07 17:48

Title

Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes

Summary

Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/better-auth/better-auth/securi…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
better-auth	better-auth	Affected: < 1.2.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53535",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-07T17:48:21.559840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-07T17:48:36.223Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "better-auth",
          "vendor": "better-auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-07T17:15:52.027Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/better-auth/better-auth/security/advisories/GHSA-36rg-gfq2-3h56",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-36rg-gfq2-3h56"
        }
      ],
      "source": {
        "advisory": "GHSA-36rg-gfq2-3h56",
        "discovery": "UNKNOWN"
      },
      "title": "Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-53535",
    "datePublished": "2025-07-07T17:15:52.027Z",
    "dateReserved": "2025-07-02T15:15:11.515Z",
    "dateUpdated": "2025-07-07T17:48:36.223Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-36RG-GFQ2-3H56

Summary

Details

Open Redirect PoCs

/reset-password/:token

/verify-email

/delete-user/callback

/magic-link/verify

/oauth-proxy-callback

Impact

CVE-2025-53535 (GCVE-0-2025-53535)

Tags

Sightings

Nomenclature

`/reset-password/:token`

`/verify-email`

`/delete-user/callback`

`/magic-link/verify`

`/oauth-proxy-callback`