{"action":"Upgrade better-auth to 1.1.20 or later.","affected":[{"fixed":"1.1.20","introduced":"0"}],"component":"better-auth","cve_ids":["CVE-2025-27143"],"ecosystem":"npm","epss":0.0035,"exploited":false,"fixed_versions":["1.1.20"],"ghsa_id":"GHSA-hjpm-7mrm-26w8","id":"tcs_01M5KFVCXQZ6E264YS98W020K0","modified_at":"2026-02-04T02:15:17.765470Z","published_at":"2025-02-24T18:27:55Z","references":["https://osv.dev/vulnerability/GHSA-hjpm-7mrm-26w8","https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723","https://github.com/better-auth/better-auth/security/advisories/GHSA-hjpm-7mrm-26w8","https://nvd.nist.gov/vuln/detail/CVE-2025-27143","https://github.com/better-auth/better-auth/commit/24659aefc35a536b95ea4e5347e52c8803910153","https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80","https://github.com/better-auth/better-auth","https://github.com/better-auth/better-auth/releases/tag/v1.1.21"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-hjpm-7mrm-26w8","url":"https://osv.dev/vulnerability/GHSA-hjpm-7mrm-26w8"},{"source":"nvd","source_id":"CVE-2025-27143","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27143"}],"summary":"Beter Auth has an Open Redirect via Scheme-Less Callback Parameter"}