CVE-2025-61928: 
Better Auth vulnerability analysis and mitigation

CVE-2025-61928 is a critical authentication bypass vulnerability in the Better Auth library for TypeScript, affecting the API key creation and update endpoints. Unauthenticated attackers can create or modify API keys for any user by supplying a victim's user ID in the request body, effectively bypassing all authentication checks. The vulnerability affects Better Auth versions prior to 1.3.26 and was disclosed on October 8–9, 2025. It carries a CVSS v4.0 base score of 9.3 (Critical) and a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory, Red Hat CVE).

The root cause is a logic flaw in the user-derivation fallback within the API key creation and update route handlers, classified as CWE-285 (Improper Authorization) and CWE-306 (Missing Authentication for Critical Function). When no session exists, the handler evaluates session?.user ?? (authRequired ? null : { id: ctx.body.userId }), where authRequired becomes false if userId is present in the request body — allowing attacker-controlled input to populate the user context. Server-side field validation (lines 280–295) only executes when authRequired is true, so privileged fields are not protected and the malicious payload is accepted without any additional authentication before the database operation. The fix in commit 5560850 changes the logic so that authRequired is always true when a request or headers are present, and adds an explicit check that a session user cannot create keys for a different userId (GitHub Advisory, GitHub Commit).

Successful exploitation allows an unauthenticated attacker to generate or modify API keys for any user in the application, granting complete authenticated access as the targeted user. Depending on the victim's privileges, this can lead to full account compromise, unauthorized access to sensitive user data, and broader application takeover. The vulnerability affects confidentiality, integrity, and availability of the targeted user's resources, and could enable lateral movement across the application if high-privilege accounts are targeted (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The EPSS score is approximately 0.125%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and no special preconditions beyond network access to the target application's API endpoint, making it trivially exploitable if discovered (GitHub Advisory).

1. Reconnaissance: Identify applications using the Better Auth library (versions < 1.3.26) with the API keys plugin enabled. This can be done by inspecting JavaScript bundles, npm package metadata, or probing for the /api/auth/api-key/create endpoint.
2. Enumerate target user IDs: Obtain a valid victim user ID through any available means — public profile pages, API responses, or other application features that expose user identifiers.
3. Craft unauthenticated request: Send an HTTP POST request to /api/auth/api-key/create without any session cookie or authentication header, including the victim's user ID in the request body: {"userId": "<victim-user-id>"}.
4. Bypass authentication logic: Because no session exists and userId is present in the body, the handler sets authRequired to false and populates the user context with the attacker-supplied ID, bypassing all authentication checks.
5. Receive API key: The server creates and returns a valid API key scoped to the victim user, with no server-side validation blocking privileged field assignment.
6. Authenticate as victim: Use the newly created API key in subsequent API requests to perform any action as the victim user, including accessing sensitive data or escalating privileges (GitHub Advisory, ZeroPath Blog).

• Network: Unexpected HTTP POST requests to /api/auth/api-key/create or /api/auth/api-key/update without a valid session cookie or Authorization header; requests containing a userId field in the body from unauthenticated sources.
• Logs: Application logs showing API key creation events for users who did not initiate the request; authentication logs with successful API key usage from unfamiliar IP addresses or user agents shortly after key creation.
• Application Data: Sudden appearance of new API keys in the database for users who did not create them; API keys with unusual metadata or privileged fields set (e.g., elevated permissions not normally granted via the client).
• Behavioral: Authenticated API activity (using API keys) from IP addresses or clients inconsistent with the legitimate user's normal access patterns, particularly for high-privilege accounts (GitHub Advisory).

Upgrade Better Auth to version 1.3.26 or later, which contains the patch that corrects the authentication logic in the API key creation and update routes (GitHub Advisory, GitHub Commit). As immediate remediation steps: audit all existing API keys in the database for unauthorized entries and revoke any suspicious keys; review application logs for unauthenticated requests to the API key endpoints; and rotate API keys for high-privilege users as a precaution. No configuration-based workaround is available — upgrading to the patched version is the only reliable fix.

The vulnerability received notable community attention on Reddit (r/netsec and r/javascript), Hacker News, Bluesky, and Mastodon, with discussions highlighting the severity of the authentication bypass and its potential for account takeover (Reddit r/netsec, Hacker News). Security media outlets including The Hacker News, SecurityOnline, eSecurity Planet, and CyberSecurityNews covered the disclosure, emphasizing the critical nature of the flaw and urging immediate patching (The Hacker News, eSecurity Planet). Emerging Threats published detection rules for the vulnerability in their October 21, 2025 ruleset update (Emerging Threats). Risky Biz also mentioned the flaw in their security bulletin (Risky Biz).