CVE-2025-27143

CVE-2025-27143 is an open redirect vulnerability affecting Better Auth, an authentication and authorization library for TypeScript, prior to version 1.1.21. The flaw stems from improper validation of the callbackURL parameter, allowing scheme-less URLs to be interpreted as fully qualified URLs by browsers. This medium-severity vulnerability (CVSS 6.1) can be exploited by an attacker crafting a malicious verification link, leading to user redirection to an attacker-controlled site for phishing or malware distribution. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.