{"id":"GHSA-4vcf-q4xf-f48m","summary":"Better Auth Passkey Plugin allows passkey deletion through IDOR","details":"# Summary\n\nAffected versions of the better-auth passkey plugin allow users with any valid session to delete arbitrary passkeys via their ID using `POST /passkey/delete-passkey`.\n\n# Details\n\n`ctx.body.id` is implicitly trusted and used in passkey deletion queries.\n\nbetter-auth applications configured with `useNumberId` may use auto incrementing IDs which makes it trivial to delete all passkeys via enumeration.","aliases":["CVE-2025-71400"],"modified":"2026-08-03T03:56:46.449448357Z","published":"2025-11-25T21:42:53Z","database_specific":{"cwe_ids":["CWE-284","CWE-639"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-11-25T21:42:53Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m"},{"type":"WEB","url":"https://github.com/better-auth/better-auth/commit/06d68239e"},{"type":"PACKAGE","url":"https://github.com/better-auth/better-auth"}],"affected":[{"package":{"name":"@better-auth/passkey","ecosystem":"npm","purl":"pkg:npm/%40better-auth/passkey"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-4vcf-q4xf-f48m/GHSA-4vcf-q4xf-f48m.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"}]}