CVE-2025-71399

CVE-2025-71399 describes a vulnerability found in `better-auth Better Auth` software, specifically in versions up to 1.4.4. This flaw resides within the `Router` component and is categorized as an improper privileges management issue. The root cause lies in `better-auth`'s reliance on the `rou3` router library, which normalizes URL paths by treating multiple consecutive slashes as a single slash (e.g., `/path`, `//path`, and `///path` are all considered the same route). This path normalization behavior can be exploited by attackers to bypass security configurations such as `disabledPaths` and path-based rate limits by inserting extra slashes into the URL path. The vulnerability, classified as CWE-269, allows for remote exploitation without requiring authentication. The issue is mitigated in deployments where a proxy or platform already normalizes URLs by collapsing multiple slashes.