CVE-2025-71400 describes an insecure direct object reference (IDOR) vulnerability in better-auth passkey before version 1.4.0. The flaw exists in the passkey deletion endpoint, where authenticated users with valid sessions can craft requests to delete passkeys by enumerating passkey IDs. This allows them to delete passkeys belonging to other users, bypassing intended authorization controls.

An attacker with a valid session and low privileges can delete passkeys of other users, potentially disrupting authentication mechanisms and causing denial of access for legitimate users. The vulnerability does not require user interaction and has a network attack vector with low complexity, making exploitation feasible in environments where authenticated sessions are accessible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the passkey deletion endpoint to trusted users only and monitor for suspicious deletion activities. Avoid exposing passkey IDs in client-controlled parameters and implement proper authorization checks on deletion requests.