High severity · published Aug 2, 2026
CVE-2025-71400
better-auth passkey before 1.4.0 IDOR via delete-passkey
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with enumerated passkey IDs to remove other users' passkeys.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
passkey · better-auth
before 1.4.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-71400
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-71400
vendor-advisory
https://github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m
third-party-advisory
https://www.vulncheck.com/advisories/better-auth-passkey-before-idor-via-delete-passkey