Описание
Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes
Summary
An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback.
Details
In the matchesPattern function, url.startsWith( can be deceived with a url that starts with one of the trustedOrigins.
Open Redirect PoCs
/reset-password/:token
/verify-email
/delete-user/callback
/magic-link/verify
/oauth-proxy-callback
Impact
Untrusted open redirects in various routes.
Пакеты
better-auth
<= 1.2.9
1.2.10
Связанные уязвимости
Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.