Medium 6.9Published Feb 24, 2025

CVE-2025-27143Beter Auth has an Open Redirect via Scheme-Less Callback Parameter

Updated under an hour ago (Nov 2, 2026, 1:40 AM ET)

Does this affect you?

It affects better-auth and 1 other product. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.35%, higher than 29% of scored CVEs.

Do this next

Start free and add your stackFree account, 3 products Every CVE for better-auth Exploited in the last 30 days

Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs, it incorrectly allows scheme-less URLs. This results in the browser interpreting the URL as a fully qualified URL, leading to unintended redirection. An attacker can exploit this flaw by crafting a malicious verification link and tricking users into clicking it. Upon successful email verification, the user will be automatically redirected to the attacker's website, which can be used for phishing, malware distribution, or stealing sensitive authentication tokens. This CVE is a bypass of the fix for GHSA-8jhw-6pjj-8723/CVE-2024-56734. Version 1.1.21 contains an updated patch.

CVSS: 6.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness (CWE): CWE-601
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.35% (percentile 29)
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Feb 25, 2025
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

better-auth better-auth better_auth:better_auth (from the name)	before 1.1.20	CNA record
better-auth better_auth better-auth:better_auth	before 1.1.21	NVD

References

References

https://github.com/better-auth/better-auth/security/advisories/GHSA-hjpm-7mrm-26w8	x-refsource-confirm, vendor-advisory
https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723	x-refsource-misc, not-applicable
https://github.com/better-auth/better-auth/commit/24659aefc35a536b95ea4e5347e52c8803910153	x-refsource-misc, patch
https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80	x-refsource-misc, patch
https://github.com/better-auth/better-auth/releases/tag/v1.1.21	x-refsource-misc, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.