CVE-2025-61928: Better Auth: Unauthenticated API key creation through api-key plugin

October 9, 2025 (updated December 9, 2025)

A critical authentication bypass was identified in the API key creation and update endpoints. An attacker could create or modify API keys for arbitrary users by supplying a victim’s user ID in the request body. Due to a flaw in how the authenticated user was derived, the endpoints could treat attacker-controlled input as an authenticated user object under certain conditions.

References

github.com/advisories/GHSA-99h5-pjcv-gr6v
github.com/better-auth/better-auth
github.com/better-auth/better-auth/commit/556085067609c508f8c546ceef9003ee8c607d39
github.com/better-auth/better-auth/security/advisories/GHSA-99h5-pjcv-gr6v
nvd.nist.gov/vuln/detail/CVE-2025-61928

Code Behaviors & Features

Detect and mitigate CVE-2025-61928 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →