CVE-2025-27143
1 advisory.
npm/better-auth CVE-2025-27143: medium 6.1, EPSS 0.35%
Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
Action: Upgrade better-auth to 1.1.20 or later.
npm i better-auth@1.1.20Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.20 | - |
Fixed versions
| 1.1.20 |
Sources
- osv: GHSA-hjpm-7mrm-26w8
- nvd: CVE-2025-27143
- https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723
- https://github.com/better-auth/better-auth/security/advisories/GHSA-hjpm-7mrm-26w8
- https://github.com/better-auth/better-auth/commit/24659aefc35a536b95ea4e5347e52c8803910153
- https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80
- https://github.com/better-auth/better-auth
- https://github.com/better-auth/better-auth/releases/tag/v1.1.21
CVE-2025-27143 · published · modified · JSON