CVE-2025-71403 affects better-auth versions prior to 1.1.20, exposing a bypass vulnerability in the trustedOrigins validation logic. The flaw impacts handling of absolute URLs and wildcard domains, allowing attackers to craft malicious callbackURL parameters that evade origin validation checks. Successful exploitation triggers open redirects that can be leveraged to steal sensitive authentication tokens. The end result can be full account takeover of affected users. The vulnerability has been documented by NVD, GitHub Security Advisories, and VulnCheck. A fix is available in better-auth version 1.1.20 and later. Users are strongly advised to upgrade immediately to mitigate the risk of token theft and account compromise.