Intel

AIKIDO-2026-10548

@better-auth/core is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF) Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published Apr 24, 2026

81

High Risk

This Affects:

JS@better-auth/core
1.3.18 - 1.6.5
Fixed in 1.6.6
Are you affected? Scan for Free

TL;DR

This package now publishes a single host and IP classification implementation used to decide whether a hostname is true loopback, a cloud or link-local style address, or a publicly routable host, including IPv4, IPv6, zone IDs, IPv4-mapped forms, and a curated set of cloud metadata style names. Earlier releases did not ship that module, so consumers spread ad hoc string checks and regular expressions that were easier to misclassify around loopback, metadata endpoints, and special ranges. The new API gives one place to enforce those rules for URL validation and outbound fetch gating across the monorepo.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

@better-auth/core is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.3.18 - 1.6.5.

How to fix this

Upgrade the @better-auth/core library to the patch version.