CVE-2025-71399: Better Auth before 1.4.5 Path Normalization Bypass via rou3
Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
better-call/rou3 (bundled in Better Auth)to a version that resolves this vulnerability.Fixed in 1.4.5 - Configuration
Apply a deployment-level URL normalization behavior (collapsing multiple slashes) so that routes are normalized and the rou3 path normalization bypass is not exploitable.
Better Auth disabledPaths configuration / path-based rate limits = Ensure upstream/proxy URL normalization collapses multiple slashes
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71399?
CVE-2025-71399 has a severity score of 8.6, indicating a high risk.
How do I fix CVE-2025-71399?
To fix CVE-2025-71399, update to Better Auth version 1.4.5 or later, which includes the patch for the vulnerability.
What causes the CVE-2025-71399 vulnerability?
CVE-2025-71399 is caused by a path normalization bypass in the rou3 router library utilized by Better Auth.
What versions of Better Auth are affected by CVE-2025-71399?
Better Auth versions before 1.4.5 are affected by CVE-2025-71399.
What type of attack does CVE-2025-71399 allow?
CVE-2025-71399 allows attackers to bypass authentication by manipulating normalized paths.