HIGH

CVE-2025-71400

2026-08-02 CVSS v3.1

CVSS

7.1

Description

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with enumerated passkey IDs to remove other users' passkeys.

Weakness (CWE)

CWE-639 Authorization Bypass (IDOR)

EPSS Score

0.2%

Probability of exploitation in next 30 days

10.5th percentile

References

https://github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m https://www.vulncheck.com/advisories/better-auth-passkey-before-idor-via-delete-passkey

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE