---
id: CVE-2025-71400
title: >-
  better-auth passkey versions before 1.4.0 contain an insecure direct object
  reference vulnerability in the passkey deletion endpoint that allows
  authenticated users to delete arbitrary passkeys by ID
summary: >-
  better-auth passkey versions before 1.4.0 contain an insecure direct object
  reference vulnerability in the passkey deletion endpoint that allows
  authenticated users to delete arbitrary passkeys by ID. Attackers with valid
  sessions can su…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L'
cwe:
  - CWE-639
published: '2026-08-02'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:34:34.997'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71400'
references:
  - url: >-
      https://github.com/better-auth/better-auth/security/advisories/GHSA-4vcf-q4xf-f48m
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/better-auth-passkey-before-idor-via-delete-passkey
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00352
epssPercentile: 0.2615
ingestedAt: '2026-08-02T13:18:29.890Z'
---

## Overview

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with enumerated passkey IDs to remove other users' passkeys.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.