“Better Auth” Framework Alert: The Double-Slash Trick That Bypasses Security Controls

A high-severity vulnerability in Better Auth, a rapidly growing TypeScript authentication framework, could allow attackers to bypass critical access controls with a simple URL manipulation, according to security advisory. Tracked with a CVSS score of 8.6, the flaw exploits a semantic discrepancy in the rou3 router, where paths such as /sign-in/email, //sign-in/email, and ///sign-in/email are treated as identical unless the hosting environment normalises them.

The risk depends heavily on hosting infrastructure; environments that collapse multiple slashes, such as Vercel with Next.js (default) or Cloudflare with specific settings, effectively neutralise the attack before it reaches the framework. Better Auth versions prior to 1.4.4 are affected, while the library reportedly handles over 2.7 million downloads per month.

The vulnerability has been patched in rou3 (commit f60b43f), and developers are advised to upgrade to Better Auth v1.4.5 or later, normalise URLs at the proxy, or apply a manual patch to strip extra slashes from req[.]url before it hits the Better Auth handler.