{"action":"Upgrade @better-auth/passkey to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"0"}],"component":"@better-auth/passkey","cve_ids":["CVE-2025-71400"],"ecosystem":"npm","epss":0.00352,"exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-4vcf-q4xf-f48m","id":"tcs_01M5KF1G4T70P94ATXZ8FNM9QD","modified_at":"2026-08-03T03:56:46.449448357Z","published_at":"2025-11-25T21:42:53Z","references":["https://osv.dev/vulnerability/GHSA-4vcf-q4xf-f48m","https://github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m","https://github.com/better-auth/better-auth/commit/06d68239e","https://github.com/better-auth/better-auth"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-4vcf-q4xf-f48m","url":"https://osv.dev/vulnerability/GHSA-4vcf-q4xf-f48m"}],"summary":"Better Auth Passkey Plugin allows passkey deletion through IDOR"}