| Package | Affected versions | Patched versions |
|---|---|---|
| better-auth | < 1.1.21 | 1.1.21 |
A bypass was discovered in the trustedOrigins validation logic—affecting both absolute URL entries and wildcard domain patterns. This flaw allows an attacker to construct a malicious callbackURL that passes origin checks and triggers an open redirect.
Because redirect endpoints include sensitive tokens (such as password-reset tokens), this vulnerability can enable one-click account takeover if a victim clicks a crafted link.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free