CVE-2025-27143: Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

The application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs (e.g., https://evil.com), it incorrectly allows scheme-less URLs (e.g., //malicious-site.com). This results in the browser interpreting the URL as https://malicious-site.com, leading to unintended redirection.

bypass for : https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723