External risk intelligence

Better Auth Authentication Bypass via API Key Creation

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-61928

The vulnerability exists in an authentication and authorization library for web applications. The affected endpoints (api/auth/api-key/create and update) are typically exposed as web API routes to facilitate user management and authentication processes, making them commonly reachable in standard web application deployments.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the Better Auth library, an authentication and authorization tool for TypeScript applications. This issue allows unauthenticated attackers to bypass security controls and create or modify API keys for any user, potentially leading to complete account takeover and unauthorized access to user data and application functions. The main concern is confirming relevance and exposure.

Unauthenticated attackers can hijack user accounts.
Critical authentication bypass allows full access.
Confirm if your applications are exposed.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this by sending a request to the API key creation or update endpoint, including a target user's ID in the request body. This bypasses authentication checks, allowing the attacker to create or modify API keys for any user and gain full access to the application as that user.

No authentication required to access endpoints.
Triggered by crafting a request with a user ID.
Grants full authenticated access as any user.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authentication and create or modify API keys for any user. When no active session is present, the system may incorrectly use a user ID provided in the request body, circumventing security checks that normally occur when a session is active. This could lead to an attacker impersonating any user and performing actions with their privileges.

API keys and user data at risk.
Unauthenticated API requests.
Unauthorized actions as any user.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical authentication bypass affects applications using the Better Auth library, potentially allowing unauthenticated attackers to create or modify API keys for any user. Given the nature of an authentication library, application owners and platform teams are likely responsible for its integration and maintenance. The first practical step is to identify all instances where this library is used, confirm their external reachability and business criticality, and then locate the accountable owner to prioritize remediation.

Identify application owners and platform teams.
Verify library usage and external exposure.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Better Auth library?

Better Auth is a TypeScript library designed to manage authentication and authorization for web applications. It simplifies tasks like user sessions, login flows, and API security. Developers integrate it into their projects to handle user management, making it a foundational component that controls how users access specific application features and data.

How does this CVE-2025-61928 bypass work?

This flaw involves Improper Authorization (CWE-285) and Missing Authentication for Critical Function (CWE-306). When no session is active, the library incorrectly trusts a user ID provided in an API request body. Because the code fails to enforce strict authentication checks for the API key creation or update routes, an attacker can supply an arbitrary user ID to create a valid key, effectively impersonating that user without proving their identity.

Do I need an active session to trigger this bug?

No. In fact, the vulnerability occurs specifically when no session exists. The code mistakenly assumes that if a user ID is present in the request body, it is valid to proceed without further authentication. If a legitimate session is already active, the library would follow standard authorization paths rather than triggering this specific bypass.

How do I know if my application is at risk?

Halo Surface Signal indicates this risk is high because Better Auth typically exposes API routes directly to the web to handle user management. If your application uses an affected version and exposes these specific API endpoints to the public internet, it is reachable. You should review your network perimeter to determine if these endpoints are accessible from outside your internal environment.

What is the first step to fix this?

The most effective action is to update the Better Auth library to version 1.3.26 or later, which contains the necessary patch to close the bypass. Before applying the update, verify where the library is used within your codebases, confirm which instances are externally reachable, and ensure your development teams are informed to prioritize this update.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.