Improper input validation in Better-auth
CVE-2025-71399
Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H.
Affected products
- Better-auth — versions 0, 1.4.4
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2025-71399?
- CVE-2025-71399 is a high-severity vulnerability in Better-auth, classified under Improper Input Validation. CVSS score: 8.6/10. Published 2026-08-02.
- How severe is CVE-2025-71399?
- High severity. CVSS v3 base score is 8.6 out of 10.