Low severity · published Jul 7, 2025
CVE-2025-53535
Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes
2.1
CVSS
0.4%
EPSS
No
On KEV
Description
Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
better-auth · better-auth
< 1.2.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53535
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53535
github.com
https://github.com/better-auth/better-auth/security/advisories/GHSA-36rg-gfq2-3h56
More from better-auth
9.6
CVE-2026-53513
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
9.3
CVE-2025-61928
Better Auth: Unauthenticated API key creation through api-key plugin
9.1
CVE-2026-114607
better-auth: OAuth state can be used as a Magic Link to sign in as another user
9.1
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
9.1
CVE-2026-53512
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins