Security readout for executives and security teams
Plain-English summary
Better Auth versions before 1.4.5 may treat URLs containing extra path separators as equivalent to normal URLs while applying security rules inconsistently. An unauthenticated remote attacker could bypass disabled-path restrictions or path-based rate limits, potentially exposing blocked functions or increasing service-disruption risk.
Executive priority
Prioritize remediation for public authentication services using affected versions, especially where disabled routes or rate limits protect sensitive or resource-intensive operations. Upgrade promptly and verify deployment artifacts. Lower urgency only after confirming reliable URL normalization across every ingress path.
Technical view
Better Auth depends on better-call and the rou3 router. Affected rou3 behavior removes empty path segments during routing, allowing differently formatted paths to reach the same handler. Before Better Auth 1.4.5, disabledPaths and rate-limit checks could be bypassed unless an upstream proxy or platform collapses multiple separators first.
Likely exposure
Internet-facing applications using Better Auth before 1.4.5 are potentially exposed when they depend on disabledPaths or path-based rate limits. Deployments are not affected through this path when their proxy or platform reliably normalizes URLs by collapsing multiple separators.
Exploitation context
The supplied record describes a network-accessible, low-complexity attack requiring no privileges or user interaction. It does not identify confirmed exploitation in the wild, and the CVE is not marked as present in KEV. Public proof-of-concept availability is not established by the bundle.
Researcher notes
The weakness is path canonicalization inconsistency involving Better Auth, better-call, and rou3, categorized as CWE-20. The bundle identifies 1.4.5 as fixed, although the VulnCheck reference title says “before 1.4.4.” Treat 1.4.5 as the remediation threshold stated by the CVE description and vendor advisory, while noting that source-label discrepancy.
Mitigation direction
- Upgrade Better Auth to version 1.4.5 or later, which bundles the corrected rou3 behavior.
- Confirm all deployed instances and lockfiles resolve to the fixed dependency versions.
- Where immediate upgrading is impossible, verify the proxy or platform collapses multiple path separators.
- Review vendor guidance before relying on upstream normalization as a compensating control.
Validation and detection
- Inventory Better Auth versions across production, staging, serverless functions, and container images.
- Confirm dependency resolution and deployed artifacts contain Better Auth 1.4.5 or later.
- Test that disabled routes remain blocked when controlled requests contain repeated path separators.
- Verify rate limits treat normalized and repeated-separator path variants as the same route.
- Review proxy behavior end-to-end, including alternate ingress paths that might bypass normalization.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-71399 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H3.94.7VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.8HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-x732-6j76-qmhm)CVE reference, VulnCheck · vendor-advisory
- Patch CommitCVE reference, VulnCheck · patch
- VulnCheck Advisory: Better Auth before 1.4.4 Path Normalization Bypass via rou3CVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.