Package	Affected Versions	Patched Versions	Severity
📦 better-auth (npm)	< 1.1.6	1.1.6	High

Better Auth versions below v1.1.6 have an open redirect vulnerability in the verify email endpoint. Attackers can exploit this flaw to redirect users to malicious websites via crafted email verification links.

Attackers can exploit this to:

• Phish users: Fake login pages trick users into revealing sensitive data.


• Damage trust: Applications using Better Auth may face reputational harm.

The issue lies in the callbackURL parameter of the verify email endpoint. Unlike other endpoints, this one skips proper domain validation during JWT verification. The vulnerability stems from a missing origin check for GET requests.

Exploit Example:

Here, the callbackURL parameter redirects users to an attacker-controlled domain.

Upgrade to Better Auth v1.1.6 or later.
This version enforces strict domain validation for callbackURL on the /verify-email path and other GET endpoints.

---

🩹 Workaround (Temporary Fix)

If upgrading isn’t possible, add a pre-check hook to validate callbackURL:

const auth = betterAuth({
hooks: {
before: (ctx) => {
if (ctx.path === “/verify-email”) {
const callbackURL = ctx.query.callbackURL;
if (!callbackURL.startsWith(‘https://trusted-domain.com’)) {
throw new Error(‘Untrusted callback URL’);
}
}
}
}
});

 

This approach checks if the callbackURL points to a trusted domain before proceeding.