by Kastro
Paper/Archive/CVE-2025-71401

CVE-2025-71401

better-auth better-auth — better-auth before 1.4.2 basePath Modification DoS

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
36
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 39.5.395 × 207.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.

Affected

ProductAffectedFixed inSource
better-auth< 1.4.21.4.2CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorygithub.com/better-auth/better-auth/security/advisories/GHSA-569q-mpph-wgwwwriteupvulncheck.com/advisories/better-auth-before-basepath-modification-dos