CVE-2025-71400 describes an insecure direct object reference (IDOR) vulnerability in better-auth passkey versions prior to 1.4.0. The flaw exists in the passkey deletion endpoint, where authenticated users can submit requests with arbitrary passkey IDs to delete passkeys belonging to other users. This indicates a lack of proper authorization checks on the resource identifier, enabling an authorization bypass. The vulnerability has a CVSS 4.0 base score of 7.1, reflecting high severity due to network attack vector, low attack complexity, and high impact on integrity.

An attacker with a valid authenticated session can delete passkeys belonging to other users by enumerating passkey IDs and submitting crafted deletion requests. This compromises the integrity of user authentication credentials managed by the passkey system, potentially leading to denial of access for legitimate users or unauthorized removal of authentication factors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Until a fix is available, restrict access to the passkey deletion endpoint to trusted users only and monitor for suspicious deletion activity if possible.