CVE-2025-53535: Better-Auth

Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.

Affected products

• Better-Auth Better-Auth: before 1.2.10 (fixed in 1.2.10)

Published 2025-07-07. Last modified 2026-06-17.