Technical impact
Better Auth relies on the rou3 router library, and older versions of rou3 normalize URLs by stripping empty segments. An attacker can send requests that include extra slashes in the path, such as /path, //path, or ///path. Because Better Auth versions prior to 1.4.5 perform no additional validation, these crafted URLs bypass the disabledPaths configuration and any path‑based rate limits that are meant to throttle or block traffic. This vulnerability is a classic input validation failure (CWE‑20) and enables an attacker to compromise critical traffic‑control mechanisms without authentication.
Affected Systems
The affected product is Better Auth, the OAuth provider application. All releases before version 1.4.5 are impacted, including 1.4.4 and older branches. No specific minor versions were enumerated beyond the major revision number.
Risk and Exploitability
The CVSS score of 8.8 places the vulnerability in the high severity range, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation is remote over HTTP and does not require credentials; an attacker can craft a single URL with extra slashes to trigger the bypass. If the deployment does not perform its own URL normalization—such as by a reverse proxy or platform component—this weakness is directly exploitable and can lead to denial of service or further bypass of security controls.
