CVE-2024-56734

Katalog CVE

CVSS 6.1 · Medium EPSS 0,39%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada better-auth better auth. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on email verification links generated by the library. The verify email callback endpoint accepts a `callbackURL` parameter. Unlike other verification methods, email verification only uses JWT to verify and redirect without proper validation of the target domain. The origin checker is bypassed in this scenario because it only checks for `POST` requests. An attacker can manipulate this parameter to redirect users to arbitrary URLs controlled by the attacker. Version 1.1.6 contains a patch for the issue.

Rincian

Terbit di NVD

30 Desember 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723 exploit · mitigasi · advisory vendor
• https://github.com/better-auth/better-auth/commit/deb3d73aea90d0468d92723f4511542b593e522f patch