What is CVE-2025-71400?

CVE-2025-71400 is a high-severity vulnerability in Better-auth Passkey, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.1/10. Published 2026-08-02.

How severe is CVE-2025-71400?

High severity. CVSS v3 base score is 7.1 out of 10.

Auth bypass in Better-auth Passkey

CVE-2025-71400

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can subm…

Vulnerability class: IDOR (Insecure Direct Object Reference)

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L.

Affected products

Better-auth Passkey — versions 0, 1.4.0

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2025-71400?: CVE-2025-71400 is a high-severity vulnerability in Better-auth Passkey, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 7.1/10. Published 2026-08-02.
How severe is CVE-2025-71400?: High severity. CVSS v3 base score is 7.1 out of 10.