CVE-2025-27143 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
Attackers can redirect users to malicious sites via scheme-less URLs in Better Auth, enabling phishing or token theft.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27143?
CVE-2025-27143 is a medium-severity vulnerability in better-auth, published on 24 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs, it incorrectly allows scheme-less URLs. This results in the browser interpreting the URL as a fully qualified URL, leading to unintended redirection. An attacker can exploit this flaw by crafting a malicious verification link and tricking users into clicking it. Upon successful email verification, the user will be automatically redirected to the attacker's website, which can be used for phishing, malware distribution, or stealing sensitive authentication tokens. This CVE is a bypass of the fix for GHSA-8jhw-6pjj-8723/CVE-2024-56734. Version 1.1.21 contains an updated patch.
Weakness: CWE-601
Which versions are affected by CVE-2025-27143?
2 open source packages ship an affected version, including better-auth. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
better-auth npm | All versions | 1.1.20 |
better-auth npm | All versions | 1.1.20 |
Products include Better-Auth Better Auth.
How do I fix CVE-2025-27143?
Upgrade better-auth to 1.1.20 or later.
Is CVE-2025-27143 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-27143 exists.
Other vulnerabilities in better-auth
- CVE-2026-53512 Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins
- CVE-2026-53516 Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email
- CVE-2024-56734 Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
- CVE-2026-53514 Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin
- CVE-2026-45337 Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
Sources
Also known as GHSA-hjpm-7mrm-26w8.