← Vulnerability feed

Vulnerability record · CVE-2024-56734 · published 30 December 2024

CVE-2024-56734: Better-auth better auth open redirect vulnerability

Better Auth · Better Auth

Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on email verification links generated by the library. The verify email callback endpoint accepts a `callbackURL` parameter. Unlike other verification methods, email verification only uses JWT to verify and redirect without proper validation of the target domain. The origin checker is bypassed in this scenario because it only checks for `POST` requests. An attacker can manipulate this parameter to redirect users to arbitrary URLs controlled by the attacker. Version 1.1.6 contains a patch for the issue.

7.9 CVSS 4.0 High EPSS 0.40% · top 68.8% CWE-601 · Open redirect
7.9CVSS 4.0 base score
0.40%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on email verification links generated by the library. The verify email callback endpoint accepts a `callbackURL` parameter. Unlike other verification methods, email verification only uses JWT to verify and redirect without proper validation of the target domain. The origin checker is bypassed in this scenario because it only checks for `POST` requests. An attacker can manipulate this parameter to redirect users to arbitrary URLs controlled by the attacker. Version 1.1.6 contains a patch for the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/better-auth/better-auth/commit/deb3d73aea90d0468d92723f4511542b593e522f Patch
https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723 ExploitMitigationVendor Advisory

Track CVE-2024-56734 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.6CVE-2026-53513Better-auth\/sso improper input validation vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST…EPSS 0.25%9.1CVE-2026-53512Better-auth better auth improper authentication vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth toke…EPSS 0.27%8.3CVE-2026-53516Better-auth better auth improper authentication vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAut…EPSS 0.29%8.1CVE-2026-53517Better-auth\/oauth-provider race condition vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oaut…EPSS 0.42%7.7CVE-2026-53514Better-auth better auth improper authentication vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtain…EPSS 0.20%7.6CVE-2026-53518Better-auth\/oauth-provider race condition vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/toke…EPSS 0.41%7.6CVE-2026-45337Better-auth better auth improper authorization vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authent…EPSS 0.21%7.1CVE-2026-53515Better-auth\/sso improper privilege management vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register…EPSS 0.43%

Source: NIST National Vulnerability Database (record CVE-2024-56734), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.