Описание
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
EPSS
Процентиль: 26%
0.00342
Низкий
7.1 High
CVSS3
Дефекты
CWE-601
Связанные уязвимости
CVSS3: 7.1
github
3 месяца назад
better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. Attackers can construct malicious callbackURL parameters that pass origin checks and trigger open redirects to steal sensitive tokens for account takeover.
EPSS
Процентиль: 26%
0.00342
Низкий
7.1 High
CVSS3
Дефекты
CWE-601