Better-auth account takeover (CVE-2025-61928) found via ZeroPath(zeropath.com)

9 pointsby etlunvor 9 Monaten4 comments

Better-auth account takeover (CVE-2025-61928) found via ZeroPath

https://zeropath.com/blog/breaking-authentication-unauthenticated-api-key-creation-in-better-auth-cve-2025-61928

4 comments

etlunvor 9 Monaten

Author here, we found it while building & documenting automated dependency assessment workflows for ZeroPath recently. Better-Auth made for a good test case given its popularity (300K weekly downloads).

The vulnerability is a logic error in how the API keys plugin determines user context when a userId is specified. Fix is in version 1.3.26. This is the kind of business logic flaw that traditional dependency vetting (stars, existing CVEs, reputation) doesn't catch. We're working on tooling to make these audits more practical at scale.

rkusrvor 9 Monaten

Interesting, wonder how long this has been latent for

subbaiksvor 9 Monaten

this is actually insane how far AI SAST like ZeroPath and others have come

adarsharmavor 9 Monaten

this is actually so cool