AIKIDO-2025-10908
better-auth is vulnerable to External Control of File Name or Path
65
Medium Risk
This Affects:
better-authTL;DR
Affected versions of this package are vulnerable to external control of file name or path through the getBaseURL function: an attacker who sends a crafted first request containing manipulated x-forwarded-host and x-forwarded-proto headers can poison the router’s basePath, causing all subsequent routes to return 404 errors for all users. This is only exploitable when baseURL is not explicitly configured and the attacker is able to make the very first request to the server after startup.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
better-auth is vulnerable to External Control of File Name or Path in versions 0.0.1 - 1.4.2.
How to fix this
Upgrade the better-auth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant