Detections
Analytics

SCA: security update for better-auth (GHSA-99h5-pjcv-gr6v)

critical Tenable Cloud Security Plugin ID 435553

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26,
 unauthenticated attackers can create or modify API keys for any user by passing that user's id in the
 request body to the `api/auth/api-key/create` route. `session?.user ?? (authRequired ? null : { id:
 ctx.body.userId })`. When no session exists but `userId` is present in the request body, `authRequired`
 becomes false and the user object is set to the attacker-controlled ID. Server-only field validation only
 executes when `authRequired` is true (lines 280-295), allowing attackers to set privileged fields. No
 additional authentication occurs before the database operation, so the malicious payload is accepted. The
 same pattern exists in the update endpoint. This is a critical authentication bypass enabling full an
 unauthenticated attacker can generate an API key for any user and immediately gain complete authenticated
 access. This allows the attacker to perform any action as the victim user using the api key, potentially
 compromise the user data and the application depending on the victim's privileges. Version 1.3.26 contains
 a patch for the issue. (CVE-2025-61928)

See Also

https://github.com/advisories/GHSA-99h5-pjcv-gr6v

Plugin Details

Severity: Critical

ID: 435553

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 10/9/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.77

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:P

CVSS Score Source: CVE-2025-61928

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/9/2025

Vulnerability Publication Date: 10/9/2025

Reference Information

CVE: CVE-2025-61928