Exploitation observed; activity peaked at 4 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-02 | 4 | Active Exploitation1Disclosure3 |
| 2026-08-03 | 1 | Patch1 |
CVE-2025-71399 Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path… https://www.cve.org/CVERecord?id=CVE-2025-71399
Post summary
The passage announces a path normalization bug in the rou3 router library used by Better Auth, where empty segments are removed, potentially impacting path handling.
FreeRDP before 3.30.0 Heap Overflow via CliprdrStream_Read URL: https://nvd.nist.gov/vuln/detail/CVE-2025-71399 Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.6
Post summary
A critical heap overflow in FreeRDP prior to 3.30.0 (CVE‑2025‑71399) affects CliprdrStream_Read; an official vendor patch has been released.
🚨*CVE* CVE-2025-71399 Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path… https://www.cve.org/CVERecord?id=CVE-2025-71399 ----- Traducción: CVE-2025-71399 Bet… http://infoflow.cloud`
Post summary
The text provides a brief technical overview of CVE‑2025‑71399 affecting the rou3 router library, noting path normalization issues that could lead to authentication bypass, but it contains no PoC, exploit code, or patch information.
Our CTI team identified a lot of activities targeting better-auth Better Auth (CVE-2025-71399) https://vuldb.com/vuln/385350/cti
Post summary
The CTI team reports numerous activities targeting CVE‑2025‑71399, indicating it is being actively exploited in the wild.
CVE-2025-71399 Path Traversal Bypass in Better Auth via URL Normalization in rou3 Router https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-71399
Post summary
A Path Traversal bypass vulnerability (CVE-2025-71399) was disclosed for the Better Auth component in rou3 Router, with technical details available via the provided Vulmon link.