https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 23:53:26 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2025-71401 <p>better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router&#39;s base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.</p> <p>better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router&#39;s base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2025-71401 https://vulnerability.circl.lu/vuln/ghsa-3q45-2fh7-66cj <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: better-auth</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-569q-mpph-wgww. This link is maintained to preserve external references.</p> <p>## Original Description</p> <p>better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router&#39;s base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: better-auth</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-569q-mpph-wgww. This link is maintained to preserve external references.</p> <p>## Original Description</p> <p>better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router&#39;s base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.</p> https://vulnerability.circl.lu/vuln/ghsa-3q45-2fh7-66cj