An authorization bypass vulnerability in better-auth/passkey versions before 1.4.0 allows authenticated attackers to manipulate passkey operations, posing a significant security risk.

This vulnerability is classified as CWE-639, an authorization bypass through user-controlled keys. The attacker must have a low level of authentication to exploit this flaw, which involves manipulating passkey deletion or management functions.

With a CVSS score of 7.1, this vulnerability poses a high risk of unauthorized account management. An attacker could potentially delete or interfere with legitimate user credentials, leading to significant service disruption and potential account takeover scenarios.

Immediate Action: Update the npm package @better-auth/passkey to version 1.4.0 or later.

Proactive Monitoring: Audit logs for unusual passkey deletion events or administrative activities that occur outside of expected user behavior.

Compensating Controls: Implement additional authorization checks at the application level to ensure that the user requesting a passkey operation is the owner of that specific credential.

Public Exploit Available: No

This vulnerability is critical for identity integrity. Organizations using the better-auth passkey module should immediately update to version 1.4.0 to ensure proper authorization checks are enforced for all passkey operations.