Detections
Analytics

SCA: security update for better-auth (GHSA-8jhw-6pjj-8723)

high Tenable Self-Hosted Container Security Plugin ID 412734

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been
 identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially
 allowing attackers to redirect users to malicious websites. This issue affects users relying on email
 verification links generated by the library. The verify email callback endpoint accepts a `callbackURL`
 parameter. Unlike other verification methods, email verification only uses JWT to verify and redirect
 without proper validation of the target domain. The origin checker is bypassed in this scenario because it
 only checks for `POST` requests. An attacker can manipulate this parameter to redirect users to arbitrary
 URLs controlled by the attacker. Version 1.1.6 contains a patch for the issue. (CVE-2024-56734)

See Also

https://github.com/advisories/GHSA-8jhw-6pjj-8723

Plugin Details

Severity: High

ID: 412734

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2024-56734

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.9

Threat Score: 6.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/30/2024

Vulnerability Publication Date: 12/30/2024

Reference Information

CVE: CVE-2024-56734

cwe: CWE-601