The better-auth npm package prior to version 1.4.2 permits an external request to configure the baseURL when it is not otherwise defined, such as when the BETTER_AUTH_URL environment variable is unset. An attacker who can make the very first request to the server after it starts can manipulate the router's base path, causing all subsequent route requests to fail with 404 errors. This results in a denial of service condition affecting all users. The issue is mitigated if baseURL is explicitly set or when deployed on managed hosting platforms that define this configuration.

This vulnerability leads to a denial of service by poisoning the router's base path, causing all routes to return 404 errors for all users. There is no confidentiality or integrity impact reported. The attack requires the ability to make the first request after server startup and is not exploitable if baseURL is explicitly configured or on typical managed hosting environments.

Upgrade better-auth to version 1.4.2 or later where this issue is fixed. If upgrading is not immediately possible, ensure that the baseURL is explicitly configured (e.g., set BETTER_AUTH_URL) to prevent external requests from setting it. Typical managed hosting platforms that define baseURL are not affected. Patch status is not explicitly confirmed in the provided data; verify the vendor advisory for current remediation guidance.