HIGH 7.1

GHSA-4vcf-q4xf-f48m

Better Auth Passkey Plugin allows passkey deletion through IDOR

Quick fix

GHSA-4vcf-q4xf-f48m — @better-auth/passkey: upgrade to the fixed version with the command below.

npm install @better-auth/passkey@1.4.0

Details

# Summary

Affected versions of the better-auth passkey plugin allow users with any valid session to delete arbitrary passkeys via their ID using `POST /passkey/delete-passkey`.

# Details

`ctx.body.id` is implicitly trusted and used in passkey deletion queries.

better-auth applications configured with `useNumberId` may use auto incrementing IDs which makes it trivial to delete all passkeys via enumeration.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / @better-auth/passkey

Introduced in: 0 Fixed in: 1.4.0

Fix npm install @better-auth/passkey@1.4.0

References

https://github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m [WEB]
https://github.com/better-auth/better-auth/commit/06d68239e [WEB]
https://github.com/better-auth/better-auth [PACKAGE]