GHSA-4vcf-q4xf-f48m: Better Auth Passkey Plugin allows passkey deletion through IDOR

November 25, 2025

Affected versions of the better-auth passkey plugin allow users with any valid session to delete arbitrary passkeys via their ID using POST /passkey/delete-passkey.

References

github.com/advisories/GHSA-4vcf-q4xf-f48m
github.com/better-auth/better-auth
github.com/better-auth/better-auth/commit/06d68239e
github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m

Code Behaviors & Features

Detect and mitigate GHSA-4vcf-q4xf-f48m with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →