CyberRota Analysis
AI-GeneratedAuthenticated users of better-auth passkey versions prior to 1.4.0 are vulnerable to an insecure direct object reference (IDOR) flaw in the passkey deletion endpoint, enabling them to delete arbitrary passkeys by ID. This vulnerability allows attackers with valid sessions to exploit the endpoint by submitting crafted requests, potentially removing passkeys belonging to other users. Organizations utilizing affected versions should prioritize patching this vulnerability to safeguard user data and maintain system integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with enumerated passkey IDs to remove other users' passkeys.