External risk intelligence

better-auth npm denial of service via base path poisoning

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-71401

The vulnerability affects an authentication library used in web applications. While it requires specific misconfiguration or a missing environment variable, authentication endpoints are typically exposed to the public internet to facilitate user login, making this a common web-facing service component.

Denial of Service

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a vulnerability in the better-auth authentication library that could allow an attacker to cause a denial of service by poisoning the router's base path. This occurs when the library is not properly configured, potentially impacting the availability of services for all users.

A flaw lets attackers crash services if authentication isn't set up.
Affects core service availability, impacting all users.
Confirm if your authentication setup is exposed.

Attack Path

How an attacker could exploit the issue

An attacker who can send the very first request to a server after it starts can exploit this vulnerability. By manipulating the `baseURL` before it's properly defined, the attacker can cause all incoming requests to be misrouted, resulting in a denial of service for all users.

Unauthenticated external network access required.
First request after server startup poisons router.
All routes return 404, causing denial of service.

Live Threat

Current exploitation, exposure, and threat context

When the `better-auth` npm package is not explicitly configured and an attacker can initiate the very first request after startup, they could potentially poison the router's base path. This could lead to all routes returning a 404 error for all users when the system is not running on typical managed hosting platforms. No system data, user data, or PII is indicated as at risk.

Router's base path configuration.
First request after startup by attacker.
Denial of service for all users.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the better-auth npm package could impact application owners and infrastructure teams responsible for authentication services. The first step is to identify all instances of this library within your environment, confirm if the `baseURL` is explicitly configured or if the application is hosted on a platform that mitigates this specific issue, and then locate the accountable owner for remediation.

Application owners should own the issue.
Verify explicit `baseURL` configuration.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is better-auth?

better-auth is an npm package used by developers to handle authentication in web applications. It simplifies the implementation of user login, registration, and security-related workflows. By integrating this library, applications can manage session data and user identity, which makes it a critical component for services that require users to sign in over the internet.

What does CWE-770 mean for CVE-2025-71401?

This vulnerability falls under CWE-770, which refers to the improper restriction of operations within the limits or resources of a system. In this case, the library fails to properly lock down the base path configuration during startup. Because it allows external inputs to define that path, it creates an opportunity for unauthorized manipulation that degrades the service's ability to process requests.

How does an attacker trigger this denial of service?

The vulnerability is triggered if an attacker sends the very first request to the application immediately after it starts. If the library has not been explicitly configured with a baseURL, it will accept this initial request's input to define the path, effectively poisoning the router. Importantly, this does not happen if the developer has already set an explicit baseURL in the environment, nor is it a risk on many typical managed hosting platforms.

Is my application at risk?

According to Halo Surface Signal, this issue is relevant if your application uses the affected library and exposes authentication endpoints to the public internet. Because authentication services are inherently designed to be reachable by external users, any misconfiguration in how the library initializes could be leveraged by remote attackers to disrupt access for everyone.

How should I respond to this vulnerability?

First, verify whether your application uses the affected versions of the better-auth package. Check your configuration files to ensure the baseURL is explicitly defined, as this prevents the library from being left in an unconfigured state. If your application currently relies on default or missing environment variables for this setting, prioritize updating your configuration to explicitly state the base path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.