CVE-2025-71400 is an IDOR in better-auth that allows any authenticated user to delete passkeys belonging to other users. The CVSS 7.1 score masks the real severity: this vulnerability is an account takeover pathway, not merely a data deletion bug.
The attack chain works like this: an attacker with a valid session deletes a victim's passkeys via the vulnerable delete endpoint, then exploits the re-enrollment recovery flow. If the attacker has compromised the victim's email or secondary credentials—which passkey ID enumeration often precedes—they can intercept or manipulate the recovery, effectively taking over the account. The passkey deletion isn't the endgame; it's the setup that forces the victim into a vulnerable state.
A critical detail the CVE description omits: determine whether passkey IDs are sequential, predictable, or cryptographically random. Sequential or predictable IDs make enumeration trivial; opaque UUIDs require an additional information disclosure source (error messages, logs, development console output). Check your application logs and error responses for passkey ID exposure—this is a common debugging artifact that can inadvertently enable the reconnaissance phase.
Also verify whether the delete endpoint requires re-authentication or step-up confirmation, or whether a valid session alone suffices. If it's the latter, that's the exact pattern this CVE exploits: session-level trust without resource-level authorization. Many auth libraries make this trade-off to reduce friction for legitimate users who need to delete their own passkeys from secondary devices—but it creates the cross-boundary vulnerability.
The supply chain dimension compounds the risk. better-auth is a library, not an application—patches don't propagate automatically to downstream deployments. Your application may bundle a vulnerable version even if the library maintainers have issued a fix. Audit your transitive dependencies, and ensure your SBOM tooling flags authentication-related CVEs in library dependencies with appropriate urgency regardless of EPSS scores.
The EPSS score (0.00202) reflects low probability of opportunistic mass exploitation, which is accurate—this isn't a remote code execution vector. But for targeted attacks with pre-existing credential access, the probability is irrelevant. Treat this as a high-severity issue in any deployment that exposes passkey functionality to authenticated users.