Security readout for executives and security teams
Plain-English summary
An authenticated user can delete another user’s passkey by targeting its identifier. This does not disclose data, but it can disrupt authentication, lock users out, and create recovery and support costs. Applications using affected better-auth passkey versions should upgrade promptly.
Executive priority
Treat this as a high-priority authentication integrity issue. Prioritize internet-facing or multi-tenant applications because any ordinary authenticated account may threaten other users’ passkeys. Accelerate upgrading and review deletion activity, while recognizing that the supplied evidence does not show active exploitation.
Technical view
better-auth passkey versions before 1.4.0 contain a CWE-639 authorization flaw in the delete-passkey endpoint. A valid session can submit another user’s passkey ID for deletion. CVSS 4.0 rates it 7.1: network-accessible, low complexity, low privileges, no user interaction, high integrity impact, and low availability impact.
Likely exposure
Exposure is limited to applications running better-auth passkey versions before 1.4.0 with the passkey deletion endpoint accessible. Exploitation requires a valid authenticated session and knowledge or enumeration of another passkey ID. The bundle does not establish how easily IDs can be enumerated in typical deployments.
Exploitation context
The supplied sources do not establish active exploitation, and the CVE is not listed as KEV in the bundle. Public advisories describe a practical authenticated attack path using crafted deletion requests, but provide no evidence here of observed attacks or public weaponization.
Researcher notes
The authorization boundary is object ownership: authentication alone must not authorize deletion of a passkey belonging to another account. Relevant characteristics are CWE-639, network reachability, low attack complexity, low privileges, and no user interaction. The bundle does not document identifier entropy, endpoint exposure defaults, detection indicators, or affected deployment prevalence.
Mitigation direction
- Upgrade better-auth passkey to version 1.4.0 or later.
- Review the vendor advisory for any deployment-specific remediation guidance.
- Investigate suspicious passkey deletions and revoke associated sessions where appropriate.
- Help affected users securely re-enrol passkeys after confirmed unauthorized deletion.
Validation and detection
- Inventory direct and transitive better-auth passkey versions across deployed applications.
- Confirm production builds use version 1.4.0 or later.
- Review logs for unusual delete-passkey activity or repeated deletion attempts.
- In an authorized test environment, verify users cannot delete passkeys owned by another test account.
- Confirm affected users retain a secure account-recovery or alternative authentication method.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-639: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-71400 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L2.84.2VulnCheckVulnerability scoring details
Base CVSS 4.0 score
7.1HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-4vcf-q4xf-f48m)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: better-auth passkey before 1.4.0 IDOR via delete-passkeyCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.