fix(deps): update dependency better-auth to v1.1.21 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
better-auth (source)	1.1.10 -> 1.1.21

GitHub Vulnerability Alerts

GHSA-9x4v-xfq5-m8x5

Summary

The better-auth /api/auth/error page was vulnerable to HTML injection, resulting in a reflected cross-site scripting (XSS) vulnerability.

Details

The value of error URL parameter was reflected as HTML on the error page: https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81

PoC

https://demo.better-auth.com/api/auth/error?error=%3Cscript%3Ealert(1)%3C/script%3E

Impact

An attacker who exploited this vulnerability by coercing a user to visit a specially-crafted URL could execute arbitrary JavaScript in the context of the user's browser.

Because better-auth is a dependency of web applications, the impact of such a vulnerability is unknowable; it depends on the functionality of the application/site using better-auth. I have calculated the CVSS score assuming the hypothetical victim is an administrator with elevated permissions and access.

CVE-2025-27143

Summary

The application is vulnerable to an open redirect due to improper validation of the callbackURL parameter in the email verification endpoint and any other endpoint that accepts callback url. While the server blocks fully qualified URLs (e.g., https://evil.com), it incorrectly allows scheme-less URLs (e.g., //malicious-site.com). This results in the browser interpreting the URL as https://malicious-site.com, leading to unintended redirection.

bypass for : GHSA-8jhw-6pjj-8723

Affected Versions

All versions prior to 1.1.19

Details

The application’s email verification endpoint (/auth/verify-email) accepts a callbackURL parameter intended to redirect users after successful email verification. While the server correctly blocks fully qualified external URLs (e.g., https://evil.com), it improperly allows scheme-less URLs (e.g., //malicious-site.com). This issue occurs because browsers interpret //malicious-site.com as https://malicious-site.com, leading to an open redirect vulnerability.

An attacker can exploit this flaw by crafting a malicious verification link and tricking users into clicking it. Upon successful email verification, the user will be automatically redirected to the attacker's website, which can be used for phishing, malware distribution, or stealing sensitive authentication tokens.

Impact

Phishing & Credential Theft – Attackers can redirect users to a fake login page, tricking them into entering sensitive credentials, which can then be stolen.

Session Hijacking & Token Theft – If used in OAuth flows, an attacker could redirect authentication tokens to their own domain, leading to account takeover.

GHSA-vp58-j275-797x

Summary

A bypass was found for the security feature trustedOrigins. This works for wild card or absolute URLs trustedOrigins configs and opens the victims website to a Open Redirect vulnerability, where it can be used to steal the reset password token of a victims account by changing the "callbackURL" parameter value to a website owned by the attacker.

Details

Absolute URLs

The issue here appears in the middleware, specifically. This protection is not sufficiente and it allows attackers to get a open redirect, by using the payload /\/example.com. We can check this is a valid URL ( or it will be a valid URL because the URL parser fix it for us ), by checking the image bellow:

// trustedOrigins = [ "https://example.com" ]
validateURL("https://attacker.com", "callbackURL") // ❌ APIError, No Redirect
validateURL("/\/attacker.com", "callbackURL")       // ✅ Redirect to http://attacker.com

Regex

The issue here is because the regex is not strong enough [^/\\]*?\.example\.com[/\\]*? ( this is the regex it will be created if we have a wildcard as config ), but we can bypass by using a payload like:

// trustedOrigins = [ "*.example.com" ]
  ┌──────────────────┐       ┌────────────────┐       ┌─────────────────┐
  │ None of [ "/\" ] │ ────▶ │ ".example.com" │ ────▶ │ One of [ "/\" ] │
  └──────────────────┘       └────────────────┘       └─────────────────┘
          demo                  .example.com                    /               ✅ Redirect to https://example.com
          demo                  .attacker.com                   /               ❌ APIError, no redirect
   http:attacker.com?           .example.com                    /               ✅ Redirect to http://attacker.com

This works because : and ? are special chars in a URL, so when the URL parser sees, http: it will fix our happily fix our URL to http://attacker.com? and make .example.com as parameter, thus, bypassing this check

PoC

We can PoC the open redirect by using the demo.better-auth.com.
If we access the URL bellow, we are redirected to example.com:

• https://demo.better-auth.com/api/auth/reset-password/x?callbackURL=/\/example.com

Impact

Every single website using the better-auth library, is vulnerable to un-auth open redirect and more importantilly, vulnerable to potential one click account take over vulnerability, as the attacker can send the victim a email to reset their account while changing the "redirectTo" parameter here, and when the victim clicks on the link, the reset token is sent to the attackers website, thus making the attacker to use the token stolen and reset the password of the victim.

---

Release Notes

better-auth/better-auth (better-auth)

v1.1.21

Compare Source

   🐞 Bug Fixes

• open-api: Add authentication schemes  -  by @​Bekacru (ee0d6)
• origin-check: Add tests for callback URLs with malicious patterns  -  by @​Bekacru (b381c)

    View changes on GitHub

v1.1.20

Compare Source

   🚀 Features

• email-otp: Add option to set a function to generate OTPs  -  by @​CordlessWool in https://github.com/better-auth/better-auth/issues/1472 (8ba7a)
• sso: Sign in using the providerId  -  by @​kamilkisiela in https://github.com/better-auth/better-auth/issues/1533 (6c67e)

   🐞 Bug Fixes

• Add email verification for in place email updates  -  by @​Bekacru (3ca6c)
• Add callback URL to update email verification link  -  by @​Bekacru (9653f)
• one-tap:
  • Update import path for generateRandomString to fix unsupported crypto import for react native  -  by @​Bekacru (ac848)
  • Remove random string generator for nonce to fix expo client  -  by @​Bekacru (6440a)
• organizaiton:
  • Restrict admins from removing or updating owners or members with creator roles  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1520 (28cc6)
• origin-check:
  • Exclude URLs with double slashes  -  by @​Bekacru (d9c57)
  • Prevent URLs with double slashes from being trusted  -  by @​Bekacru (24659)
• session:
  • Include expiresAt in session data for HMAC verification  -  by @​Bekacru (da62e)

    View changes on GitHub

v1.1.19

Compare Source

   🚀 Features

• cli: Add support for auth.server.ts  -  by @​ardasoyturk in https://github.com/better-auth/better-auth/issues/1456 (b9ccf)
• mongodb-adapter: Support custom ID generation in MongoDB adapter  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1444 (59990)
• one-tap: Improve Google One Tap integration with JWT verification and improved prompt handling  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1452 (8ff19)
• two-factor: Activate two factor with email OTP to avoid Insecure skipVerificationOnEnable  -  by @​GregorWedlich in https://github.com/better-auth/better-auth/issues/1445 (28f18)

   🐞 Bug Fixes

• admin:
  • Impersonate user session expiration  -  by @​Kinfe123 in https://github.com/better-auth/better-auth/issues/1471 (072c5)
  • Unban should reset expiration date and reason  -  by @​Kinfe123 in https://github.com/better-auth/better-auth/issues/1469 (954b1)
• api:
  • Config in getSessionFromCtx overrides query param  -  by @​Kinfe123 in https://github.com/better-auth/better-auth/issues/1496 (261fe)
• auth:
  • Use options.baseURL instead of ctx.baseURL on trusted origins  -  by @​Bekacru (5dfb7)
• db:
  • Normalize email to lowercase in change email verification  -  by @​Bekacru (d80a1)
• email-otp:
  • Don’t save email address as user name  -  by @​benkingcode and benkingcode in https://github.com/better-auth/better-auth/issues/1519 (5f6cb)
• generic-oauth:
  • Support allowDifferentEmails on Generic OAuth Plugin  -  by @​alessandrojean in https://github.com/better-auth/better-auth/issues/1481 (9c3b5)
• jwt-plugin:
  • Include alg in jwks response  -  by @​runreal-warman (459e7)
• oauth:
  • Set tokens on oauth account created during link  -  by @​thiagofelix in https://github.com/better-auth/better-auth/issues/1462 (e5133)
• oidc-plugin:
  • User info endpoint casing to match OIDC spec  -  by @​stephenlacy in https://github.com/better-auth/better-auth/issues/1446 (2ecd3)
  • DeleteVerificationValue call by id  -  by @​runreal-warman (c0bd4)
  • Store and handle nonce value  -  by @​runreal-warman (c39e1)
  • Sub is required /userinfo response  -  by @​runreal-warman in https://github.com/better-auth/better-auth/issues/1504 (8ac1f)
• open-api:
  • Convert path parameters to OpenAPI format  -  by @​Phanuwat-Pao in https://github.com/better-auth/better-auth/issues/1437 (da2fd)
  • Add missing id field in generated OpenAPI for each schema (Models)  -  by @​astahmer in https://github.com/better-auth/better-auth/issues/1491 (add38)
• passkey:
  • Remove client export from the server plugin  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1511 (bf47a)

    View changes on GitHub

v1.1.18

Compare Source

   🚀 Features

• Custom generate token function for magic links  -  by @​t3duk in https://github.com/better-auth/better-auth/issues/1362 (b3371)
• Support function for trusted origins configuration  -  by @​ping-maxwell and @​Bekacru in https://github.com/better-auth/better-auth/issues/1151 (8c31e)
• admin: Set user password  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1203 (f7a49)
• generic-oauth: OAuth2 link account  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1208 (a609a)
• organization: Leave organization  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1239 (b26f8)
• username: Add default validation and options for validating username  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1345 (b1e27)

   🐞 Bug Fixes

• Remove zod type export from clients  -  by @​Bekacru (ec241)
• Log error in handleOAuthUserInfo  -  by @​Bekacru (193df)
• Use Partial for body and query in InferRoute type  -  by @​Bekacru (07d48)
• Database hooks should use Partial types to avoid overwriting previous hooks returns  -  by @​Bekacru (00a07)
• cli: Add on delete cascade constraint to drizzle references  -  by @​gregtjack in https://github.com/better-auth/better-auth/issues/1419 (f011c)
• expo: Headers should be retrieved from APIError in OAuth hook  -  by @​Bekacru (0ea9c)
• phone-number: Ensure callbackOnVerification is called after user verification  -  by @​Bekacru (1e318)
• rate-limit: Use the passed model name for rate limiter storage  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1412 (9445d)

    View changes on GitHub

v1.1.17

Compare Source

   🐞 Bug Fixes

• Update user should use id as a reference  -  by @​Bekacru (745f9)
• Update session cache on email verification  -  by @​Bekacru (2628b)
• SocialProvider return null if undefined  -  by @​baptisteArno in https://github.com/better-auth/better-auth/issues/1371 (b26a2)
• Allow partial returns from update hooks  -  by @​Bekacru (aaa5c)
• auth: Update cookie handling in anonymous and multi-session plugins  -  by @​Bekacru (c253b)
• cli: Wrong kysely schema filename  -  by @​alfanjauhari and Alfan Jauhari in https://github.com/better-auth/better-auth/issues/1366 (81936)
• drizzle: Drizzle with mysql update breaks on anything other than update by id  -  by @​Kinfe123 and @​Bekacru in https://github.com/better-auth/better-auth/issues/1377 (0794d)
• username: Return email not verified instead of invalid email and password  -  by @​Bekacru (90a48)

    View changes on GitHub

v1.1.16

Compare Source

   🚀 Features

• Add cookie helper for middlewares  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1275 (2eca1)
• Add refetch function for all client hooks  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1206 (05afc)

   🐞 Bug Fixes

• Trigger session update on delete user  -  by @​Bekacru (0df2b)
• Handle converting date on session parsing from cookie cache  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1342 (90064)
• Google IdToken auth issuer mismatch  -  by @​abegehr in https://github.com/better-auth/better-auth/issues/1351 (e83c0)
• Make session table optional when secondary storage is provided  -  by @​Bekacru (4c2ef)
• anonymous:
  • Add sign-up route to linking matcher  -  by @​Bekacru (6e659)
  • Link account user and session type should be less strict  -  by @​Bekacru (2cb80)
• drizzle:
  • Incorrect call to getModelName  -  by @​chrnorm in https://github.com/better-auth/better-auth/issues/1329 (9a3e2)
  • Drizzle adapter failing to return data on create and update when using mysql  -  by @​Kinfe123 in https://github.com/better-auth/better-auth/issues/1358 (4748b)
• oidc:
  • Missing content type header on openId configuration endpoint  -  by @​Bekacru (cb91d)
• passkey:
  • Use options base url for rpID  -  by @​Bekacru (2da63)
• security:
  • Santize query param on error page  -  by @​Bekacru (7ae34)

    View changes on GitHub

v1.1.15

Compare Source

   🚀 Features

• Allow manually linking account with different email address than user  -  by @​D3visionNL in https://github.com/better-auth/better-auth/issues/1238 (14377)
• Support .js config  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1256 (db4b4)
• Support mssql directly  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1255 (d7b4d)

   🐞 Bug Fixes

• Allow plugins to set email and password values  -  by @​kzlar in https://github.com/better-auth/better-auth/issues/1212 (f61d8)
• Improve additional fields inference ts server performance  -  by @​Bekacru (fe066)
• Ensure correct status code for unverified email in sign-in  -  by @​DilbertRV in https://github.com/better-auth/better-auth/issues/1262 (1e6b2)
• Expo client with cookie-cache overwrites the original token  -  by @​kzlar in https://github.com/better-auth/better-auth/issues/1269 (1280c)
• Make plugin options type exports consistent  -  by @​hongkongkiwi in https://github.com/better-auth/better-auth/issues/1270 (13d24)
• Allow custom body properties  -  by @​Bekacru (ab325)
• Mssql returning should use outputAll  -  by @​Bekacru (a8bfe)
• Use redirect URI from options rather than manually overriding  -  by @​arlyon in https://github.com/better-auth/better-auth/issues/1289 (cff6a)
• sendInvitationEmail use lowercase email  -  by @​ping-maxwell in https://github.com/better-auth/better-auth/issues/1283 (5f34c)
• expo: Make expo origin override optional  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1236 (18e9e)
• oauth-proxy: Add production url param for oauth proxy  -  by @​Bekacru (66bff)
• organization: Update list organization atom on update organization  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1235 (4f456)
• passkey: GetRpID did not trim path when baseURL has no port  -  by @​canstand in https://github.com/better-auth/better-auth/issues/1250 (dfcce)
• rate-limiter: Convert bigint lastRequest to number  -  by @​ammarmbe in https://github.com/better-auth/better-auth/issues/1232 (12c7d)

    View changes on GitHub

v1.1.14

Compare Source

   🚀 Features

• Support Microsoft Entra ID select_account prompt  -  by @​t3duk in https://github.com/better-auth/better-auth/issues/1219 (e57b1)
• Add organization deletion config  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1227 (0046e)

   🐞 Bug Fixes

• generic-oauth: Remove code verifier on verification request if pkce isn't enabled  -  by @​Bekacru (6dc84)

    View changes on GitHub

v1.1.13

Compare Source

   🐞 Bug Fixes

• Mark nanostore and better fetch as direct dependencies  -  by @​Bekacru (4a89f)

    View changes on GitHub

v1.1.12

Compare Source

   🚀 Features

• Custom schema options for username plugin  -  by @​ping-maxwell in https://github.com/better-auth/better-auth/issues/1129 (6c64a)
• Add IdToken login support for facebook  -  by @​reslear in https://github.com/better-auth/better-auth/issues/1078 (f5db2)
• SecondaryStorage and storeSessionInDatabase behavior  -  by @​wh5938316 in https://github.com/better-auth/better-auth/issues/1172 (b27b5)
• New user callback url for sso and generic oauth  -  by @​kzlar in https://github.com/better-auth/better-auth/issues/1176 (1a97e)
• magic-link: Support passing name for registration through magic link  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1205 (68c4d)

   🐞 Bug Fixes

• Remove current url from requests  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1187 (3aa95)
• Number mapping for rate limit migration  -  by @​iqorex in https://github.com/better-auth/better-auth/issues/1191 (b8c46)
• Remove current url from requests "  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1187 (fd457)
• Remove current url from requests  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1193 (35df4)
• Database hooks merge issue with plugin  -  by @​kzlar in https://github.com/better-auth/better-auth/issues/1177 (f3090)
• Update scope on oauth re-login  -  by @​Bekacru (2161e)
• vue: Failing hook type  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1207 (b42fa)

    View changes on GitHub

v1.1.11

Compare Source

   🐞 Bug Fixes

• Check new user callback url  -  by @​Bekacru (e97e2)
• Stricter origin check  -  by @​hyoban in https://github.com/better-auth/better-auth/issues/1158 (0816e)
• Validate org membership to get organization details  -  by @​msywulak (e2bde)
• Remove trailing slashes from base url  -  by @​snelusha in https://github.com/better-auth/better-auth/issues/1182 (db4f9)
• anonymous: Filter specefic endpoints for linking  -  by @​Bekacru (a1db4)
• expo: Support linking for new user and error callbacks  -  by @​kzlar in https://github.com/better-auth/better-auth/issues/1181 (52c06)
• jwt: Add required alg parameter to importJWK  -  by @​9j in https://github.com/better-auth/better-auth/issues/1161 (e06c9)
• two-factor: Set updated userinfo in cookie cache on 2fa disable  -  by @​Scooter1337 in https://github.com/better-auth/better-auth/issues/1140 (42503)

    View changes on GitHub

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.