Authentication bypass in Better Auth API keys plugin
CVE-2025-61928 is an authentication and authorization logic flaw in Better Auth's API keys plugin affecting versions prior to 1.3.26. The vulnerable create and update API key routes accept a user-supplied userId in the request body and incorrectly derive user context with logic equivalent to session?.user ?? (authRequired ? null : { id: ctx.body.userId }). When no valid session exists but userId is present, authRequired becomes false and the request is processed using an attacker-controlled user object. Because server-only field validation is only executed when authRequired is true, privileged fields can also bypass intended validation. No additional authentication check occurs before the database operation, allowing unauthenticated attackers to create or modify API keys for arbitrary users.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
api/auth/api-key/create and corresponding update routes at the application, gateway, or reverse-proxy layer. Reject any client-supplied userId for identity selection on these endpoints and require identity to come only from validated session state. Monitor for anomalous API key creation/update activity, especially requests lacking a valid session but containing userId, and revoke suspicious keys. Additional compensating controls include WAF/API gateway rules, strict route-level authentication enforcement, and temporary restriction of API key management to trusted administrative workflows.Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Recent activity
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability listed as trending; no technical details provided in the content.
An authentication/authorization logic flaw in better-auth’s API keys plugin that allowed unauthenticated creation or update of API keys for arbitrary users by supplying a victim user ID in the request body.
A critical authentication bypass vulnerability in Better Auth that allows attackers to steal user API keys.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.