Open Redirect in Better-Auth
CVE-2025-53535
Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.
Vulnerability class: Open Redirect
EPSS: 0.003 (26.0th percentile) — read the EPSS interpretation.
Affected products
- Better-auth — versions < 1.2.10
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)