Critical Auth Bypass (CVE-2025-61928) in Better Auth Allows Hackers to Steal User API Keys

A critical authentication bypass, CVE-2025-61928, has been discovered in Better Auth, a TypeScript authentication library, with the flaw rated CVSSv4 9.3 (Critical) and affecting Better Auth versions 1.3.25 and earlier. According to the article, unauthenticated attackers can create or modify API keys for any user, leading to complete compromise of accounts and applications using the affected plugin.

The vulnerability stems from how Better Auth derives user identity when processing API key creation requests, where the system may treat a request as authenticated if a userId is present in the body and no active session exists. The article notes that server-only field validation only runs when authRequired is true, allowing the attacker’s request to bypass authentication and write a malicious payload to the database, generating an API key for the victim user; a similar issue exists in the update endpoint.

A fix was released in version 1.3.26, which introduces stricter authentication enforcement and disables unauthenticated access to the affected API key routes; the vulnerability affects the earlier 1.3.25 version. The exploit can be triggered with a simple curl request: curl -X POST http://localhost:3000/api/auth/api-key/create -H 'Content-Type: application/json' -d '{ "userId": "victim-user-id", "name": "zeropath" }'.