-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability allows an unauthenticated attacker to create API keys for any user by exploiting a flaw in the authentication logic. The analysis of the provided commit 556085067609c508f8c546ceef9003ee8c607d39 confirms this.
The patch modifies the createApiKey function in packages/better-auth/src/plugins/api-key/routes/create-api-key.ts. The original code made authentication optional if a userId was present in the request body, which is the root cause of the vulnerability. An attacker could simply include a victim's userId in the POST request to /api/auth/api-key/create to generate an API key for that user.
The vulnerable function identified is createApiKey. The patch replaces the flawed logic with a stricter check that ensures a session exists for the request and that the userId in the body matches the session's user ID if provided. Although the vulnerability description mentions a similar flaw in an 'update endpoint', the provided commit only contains changes for the creation endpoint. Therefore, the analysis is focused on the explicitly patched createApiKey function.
createApiKeypackages/better-auth/src/plugins/api-key/routes/create-api-key.ts
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| better-auth | npm | < 1.3.26 | 1.3.26 |
Ongoing coverage of React2Shell