The vulnerability is an insecure direct object reference in the passkey deletion endpoint. An authenticated user can submit a delete request with any passkey ID, causing the target passkey to be removed without ownership verification. This defeat of the ownership check removes the target user’s credential store, potentially eliminating their access and compromising the integrity of user data.

The flaw exists in the better-auth:passkey service in all productions releases before version 1.4.0. Any deployment running those earlier releases is vulnerable.

The CVSS score of 7.1 reflects moderate‑to‑high risk; the EPSS score is currently unavailable, but the lack of public exploits does not preclude an attacker with a valid session from performing the deletion. The attack vector is remote through crafted HTTP requests to the delete‑passkey endpoint, and the vulnerability is listed as not in the CISA KEV catalog. An attacker only needs an authenticated session; no special privilege or additional privileges are required beyond the user’s own access rights.