EUVD-2026-246549

fkie_cve-2025-53535

Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.

GHSA-36rg-gfq2-3h56 — Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes

Affected: npm: better-auth

### Summary

An open redirect has been found in the `originCheck` middleware function, which affects the following routes: `/verify-email`, `/reset-password/:token`, `/delete-user/callback`, `/magic-link/verify`, `/oauth-proxy-callback`.

### Details

In the `matchesPattern` function, `url.startsWith(` can be deceived with a `url` that starts with one of the `trustedOrigins`.

```jsx const matchesPattern = (url: string, pattern: string): boolean => { if (url.startsWith("/")) { return false; } if (pattern.includes("*")) { return wildcardMatch(pattern)(getHost(url)); } return url.startsWith(pattern); }; ```

### Open Redirect PoCs

```jsx export const auth = betterAuth({ baseURL: 'http://localhost:3000', trustedOrigins: [ "http://trusted.com" ], emailAndPassword: { ... }, }) ```

#### `/reset-password/:token`

#### `/verify-email`

#### `/delete-user/callback`

<img width="545" alt="image" src="https://github.com/user-attachments/assets/2ff1b217-d069-48fb-81c1-f8…

Most recent entries from all

EUVD-2026-246549

fkie_cve-2025-53535

GHSA-36rg-gfq2-3h56 — Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes