The vulnerability in better-auth prior to version 1.1.20 involves a bypass in the trustedOrigins validation logic. Specifically, the validation fails to correctly handle absolute URLs and wildcard domains, allowing attackers to construct malicious callbackURL parameters that pass origin checks improperly. This results in open redirect conditions that can be exploited to steal sensitive authentication tokens, facilitating account takeover attacks. The issue is tracked as CVE-2025-71403 and is classified as CWE-601 (Open Redirect). The CVSS 3.1 base score is 7.1, reflecting a network attack vector with low complexity, no privileges required, user interaction needed, and impacts confidentiality and integrity.

Successful exploitation can lead to open redirect attacks that enable attackers to steal sensitive tokens from users. This can result in account takeover, compromising user accounts and associated data confidentiality and integrity. The vulnerability does not impact availability. The attack requires user interaction but no privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions in sensitive environments and monitor for updates from the vendor. Implement additional validation or filtering on callbackURL parameters if possible to mitigate open redirect risks.