CVE-2025-71400: better-auth passkey before 1.4.0 IDOR via delete-passkey
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with enumerated passkey IDs to remove other users' passkeys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
better-auth passkeyto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71400?
The severity of CVE-2025-71400 is rated high with a score of 7.1.
How do I fix CVE-2025-71400?
To fix CVE-2025-71400, upgrade to better-auth passkey version 1.4.0 or later.
What type of vulnerability is CVE-2025-71400?
CVE-2025-71400 is an insecure direct object reference (IDOR) vulnerability in the passkey deletion endpoint.
Who is affected by CVE-2025-71400?
Authenticated users of better-auth passkey versions before 1.4.0 are affected by CVE-2025-71400.
What can attackers do with CVE-2025-71400?
Attackers can delete arbitrary passkeys by submitting crafted requests to the delete-passkey endpoint.