GHSA-vp58-j275-797x: Better Auth allows bypassing the trustedOrigins Protection which leads to ATO
(updated )
A bypass was discovered in the trustedOrigins validation logic—affecting both absolute URL entries and wildcard domain patterns. This flaw allows an attacker to construct a malicious callbackURL that passes origin checks and triggers an open redirect.
Because redirect endpoints include sensitive tokens (such as password-reset tokens), this vulnerability can enable one-click account takeover if a victim clicks a crafted link.
References
- github.com/advisories/GHSA-vp58-j275-797x
- github.com/better-auth/better-auth
- github.com/better-auth/better-auth/blob/ddebd0358d74376ea64541512d0167dd4377f182/packages/better-auth/src/api/middlewares/origin-check.ts
- github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80
- github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x
Code Behaviors & Features
Detect and mitigate GHSA-vp58-j275-797x with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →