The vulnerability exists in the better‑auth npm package prior to version 1.4.2. An unauthenticated external user can send a request to the application immediately after it starts. Because the baseURL parameter is undefined at that time, the first request can set the router’s base path. After this change, all normally reachable endpoints respond with a 404 status, effectively disrupting service for all users. The flaw is a form of resource exhaustion that leads to denial of service, and is classified as CWE‑770.

The affected product is better‑auth (the npm OAuth provider). The vulnerability applies to all releases before 1.4.2. Production environments that rely on the default configuration where BETTER_AUTH_URL is not set, or that use managed hosting platforms that do not predefine the baseURL, are at risk.

The advisory assigns a CVSS score of 9.3, indicating a severe impact. EPSS data is unavailable, and the vulnerability is not currently listed in CISA’s KEV catalog. Attackers only need to send an HTTP request to the application on the very first request after startup, which is feasible over any exposed port. Because the attack does not require authentication or privilege escalation, it is considered likely that an external threat actor could exploit this in a production environment if the service is publicly reachable and no safeguards are in place.