CVE-2025-71401

Published Aug 2, 2026

Last updated 2 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-71401 is a vulnerability affecting the `better-auth` npm package in versions prior to 1.4.2. It allows an external request to configure the `baseURL` if it has not been explicitly defined, such as when the `BETTER_AUTH_URL` environment variable is unset. This issue stems from the product not properly controlling the allocation and maintenance of a limited resource, leading to resource consumption. An attacker who is able to make the very first request to the server after startup can exploit this vulnerability to "poison" the router's base path. This manipulation causes all subsequent routes to return 404 errors for all users, effectively leading to a denial of service. The vulnerability is not exploitable if the `baseURL` is explicitly configured or if the application is running on typical managed hosting platforms.

Description
better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.
Source
disclosure@vulncheck.com
NVD status
Received

Risk scores

CVSS 4.0

Type
Secondary
Base score
9.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
CRITICAL

CVSS 3.1

Type
Secondary
Base score
5.9
Impact score
3.6
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity
MEDIUM

Weaknesses

disclosure@vulncheck.com
CWE-770

Social media

Hype score
Not currently trending