-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided security patch (commit 556085067609c508f8c546ceef9003ee8c607d39) for the vulnerability in 'better-auth' clearly points to the createApiKey function as the source of the vulnerability. The diff in packages/better-auth/src/plugins/api-key/routes/create-api-key.ts shows the exact lines of code that were changed to fix the authentication bypass. The vulnerability description corroborates this, explaining how the logic in the createApiKey route could be exploited. The PoC provided also targets the api/auth/api-key/create endpoint, which is handled by the createApiKey function. Although the vulnerability description mentions that a similar pattern exists in an 'update endpoint', the provided commit only contains the fix for the creation endpoint. Therefore, with high confidence, createApiKey is identified as a vulnerable function. An attacker exploiting this vulnerability would have this function appear in the runtime profile.
createApiKeypackages/better-auth/src/plugins/api-key/routes/create-api-key.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| better-auth | npm | < 1.3.26 | 1.3.26 |
JavaScriptJavaScriptOngoing coverage of React2Shell