Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, …

CVE-2025-71399 affects Better Auth versions prior to 1.4.5, which relies on the rou3 router library through better-call. The vulnerability stems from rou3 normalizing URL paths by removing empty segments, causing /path, //path, and ///path to resolve to the same route. Attackers can exploit this behavior by submitting requests with extra slashes in the URL path to bypass disabledPaths configuration settings and circumvent path-based rate limiting controls. The fix was bundled in Better Auth version 1.4.5, which includes a patched version of rou3. Deployments that use a proxy or platform that normalizes URLs by collapsing multiple slashes are not affected. The issue represents an authentication and access control bypass risk in web applications using Better Auth.