CVE-2025-53535 Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes
An open redirect in Better Auth's originCheck middleware allows attackers to redirect users to malicious sites via specific authentication routes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-53535?
CVE-2025-53535 is a low-severity vulnerability in better-auth, published on 7 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.
Weakness: CWE-601
Which versions are affected by CVE-2025-53535?
2 open source packages ship an affected version, including better-auth.
| Package | Affected | Fixed in |
|---|---|---|
better-auth npm | All versions | 1.2.10 |
better-auth npm | All versions | 1.2.10 |
How do I fix CVE-2025-53535?
Upgrade better-auth to 1.2.10 or later.
Is CVE-2025-53535 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53535 exists.
Sources
Also known as GHSA-36rg-gfq2-3h56.