AIKIDO-2026-10373
better-auth is vulnerable to Open Redirect
47
Medium Risk
This Affects:
better-authTL;DR
The password reset request endpoint (requestPasswordReset) did not validate the redirectTo parameter against trusted origins. A client could send a redirectTo pointing to an untrusted or malicious URL; after the user completed the reset flow they could be redirected there, enabling open redirect and phishing. Before the fix, no origin check middleware was applied to this route, so redirectTo was not validated. The patch adds originCheck((ctx) => ctx.body.redirectTo) to the request handler so untrusted redirectTo values are rejected with 403 and Invalid redirectURL.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
better-auth is vulnerable to Open Redirect in versions 1.0.0 - 1.5.4.
How to fix this
Upgrade the better-auth library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant