CVE-2025-71401 in better-auth is being undersold by its CVSS 5.9 and EPSS 0.0026. Don't let the numbers fool you—this is a configuration-state exploit with catastrophic blast radius that deserves serious attention in production deployments.
The vulnerability: when baseURL is not explicitly configured, better-auth infers it from the first incoming request. An attacker can send a crafted request with a malicious baseURL value during this initialization window, and the router's path resolution becomes permanently poisoned. Every request after that—legitimate or otherwise—returns 404. This isn't a temporary denial-of-service; the poisoned state persists across process restarts if it gets cached.
The "very first request" constraint sounds limiting, but it's exploitable in practice. If you deploy on a CI/CD pipeline with predictable restart timing, or if you know the deployment timestamp, you can hit this window with precision. Don't assume the attacker is random.
Here's what to check now: locate every better-auth instance in your stack and verify that baseURL is explicitly set in configuration—not inferred from environment variables or request headers. If you're running on a managed platform (Railway, Fly.io, Vercel, AWS Amplify), verify that BETTER_AUTH_URL is actually being injected and that your initialization sequence guarantees it's present before the first request arrives. Be especially careful during cold starts, horizontal scaling events, and blue-green deployments where timing gaps can open the window.
The low EPSS score reflects the difficulty of mass exploitation, but targeted attacks against specific deployments are far more feasible. If an attacker knows you're using better-auth and can observe your deployment patterns, the barrier to exploitation drops significantly. Treat this as a targeted-threat vulnerability, not a mass-exploit one.