An open redirect vulnerability in better-auth enables attackers to deceive users into visiting malicious websites, facilitating phishing and credential theft.

This is an open redirect flaw (CWE-601) resulting from a bypass of the trusted origins check. The attack vector is network-based and can be performed by an unauthenticated attacker.

By manipulating redirect parameters, attackers can facilitate phishing attacks that appear legitimate, leading to potential credential harvesting or the distribution of malware. With a CVSS score of 7.1, this vulnerability poses a significant risk to user trust and overall security posture.

Immediate Action: Update the better-auth npm package to version 1.1.21 or later.

Proactive Monitoring: Review web application traffic for suspicious redirect targets and investigate any reports of users being sent to unexpected external domains.

Compensating Controls: Implement allow-lists for redirect destinations to ensure that only approved domains are permitted in application redirect logic.

Public Exploit Available: Unknown

Developers should prioritize the update to version 1.1.21 immediately. Open redirects are frequently used as a secondary vector in larger attack chains, and addressing this vulnerability is essential for maintaining a secure authentication flow.