| Package | Affected versions | Patched versions |
|---|---|---|
| better-auth | < 1.2.10 | 1.2.10 |
An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback.
In the matchesPattern function, url.startsWith( can be deceived with a url that starts with one of the trustedOrigins.
const matchesPattern = (url: string, pattern: string): boolean => {
if (url.startsWith("/")) {
return false;
}
if (pattern.includes("*")) {
return wildcardMatch(pattern)(getHost(url));
}
return url.startsWith(pattern);
};
export const auth = betterAuth({
baseURL: 'http://localhost:3000',
trustedOrigins: [
"http://trusted.com"
],
emailAndPassword: {
...
},
})
/reset-password/:token/verify-email/delete-user/callback/magic-link/verify/oauth-proxy-callbackUntrusted open redirects in various routes.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free