---
id: "GHSA-gv75-j3v8-3crm"
page: "https://infrastack.ai/live/GHSA-gv75-j3v8-3crm"
kind: "vulnerability"
aliases: ["GHSA-gv75-j3v8-3crm"]
title: "@better-auth/passkey: Passkey verification does not enforce origin or user verification"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@better-auth/passkey", "fixed": ["1.7.16"], "affected": ">= 1.4.0-beta.16, < 1.7.16", "ecosystem": "npm"}, {"name": "@better-auth/passkey", "fixed": ["1.8.0-beta.5"], "affected": ">= 1.8.0-beta.0, < 1.8.0-beta.5", "ecosystem": "npm"}, {"name": "better-auth", "fixed": ["1.4.0"], "affected": ">= 1.2.0-beta.18, < 1.4.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["better-auth", "cwe-346", "cwe-602", "node", "package", "passkeys", "webauthn"]
not_affected_if: ["default-config", "no-passkey-plugin"]
published_at: "2026-11-03T21:40:10+00:00"
first_seen_at: "2026-11-09T22:53:20+00:00"
updated_at: "2026-11-09T22:57:28+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-gv75-j3v8-3crm", "first_seen_at": "2026-11-09T22:53:20+00:00"}]
exploit_sources: []
---

# @better-auth/passkey: Passkey verification does not enforce origin or user verification

Link for people: https://infrastack.ai/live/GHSA-gv75-j3v8-3crm (this .md is for agents)

The passkey plugin in @better-auth/passkey and better-auth took the expected WebAuthn origin from the request rather than server configuration, and did not confirm PIN or biometric checks when userVerification is required. An attacker on another origin under the same relying party ID could have a passkey response accepted, and a user could register or use a passkey without the required user verification.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@better-auth/passkey affected >= 1.4.0-beta.16, < 1.7.16 fixed 1.7.16
- npm:@better-auth/passkey affected >= 1.8.0-beta.0, < 1.8.0-beta.5 fixed 1.8.0-beta.5
- npm:better-auth affected >= 1.2.0-beta.18, < 1.4.0 fixed 1.4.0

## How to check

- Check the installed version of `@better-auth/passkey` (for example `npm ls @better-auth/passkey`) and of `better-auth`.
- Look for `authenticatorSelection.userVerification` set to `"required"` in the passkey configuration.
- Check whether the relying party ID (`rpID`) covers origins you do not control, such as other subdomains.

## Fix

- `@better-auth/passkey`: `1.7.16` on the stable line, or `1.8.0-beta.5` on the beta line.
- `better-auth`: `1.4.0` (the built-in passkey plugin before 1.4.0 is affected).
- Configuration: set the `origin` option when `rpID` is set and a wildcard in `baseURL.allowedHosts` covers it.

## Timeline

- 2026-11-09T22:53:20+00:00 ghsa-repo https://github.com/better-auth/better-auth/security/advisories/GHSA-gv75-j3v8-3crm

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/better-auth/better-auth/security/advisories/GHSA-gv75-j3v8-3crm

## From the sources

## Am I affected?

You are affected if you use `@better-auth/passkey` 1.4.0-beta.16 or later, or the passkey plugin built into `better-auth` before 1.4.0, and **any** of these is true:

- You set `authenticatorSelection.userVerification` to `"required"`.
- Your relying party ID also covers origins you do not control, such as other subdomains.

## Summary

**User verification.** With `userVerification: "required"`, the server asked the authenticator to verify the user, for example with a PIN or fingerprint, but did not confirm that it happened. The default `"preferred"` setting allows responses without this check by design.

**Origin.** The server took the expected WebAuthn origin from the request instead of from its configuration.

## Impact

A user can register or use a passkey without the PIN or biometric check your application requires. A passkey response created on another origin under the same relying party ID could be accepted. Neither problem lets anyone register a passkey for another user's account or skip the sign-in needed to register one.

## Patches

Upgrade `@better-auth/passkey` to 1.7.16, or to 1.8.0-beta.5 on the beta line.

The expected origin now comes from the `origin` option, or from the `baseURL` origin plus a frontend origin listed exactly in `trustedOrigins`. Set `origin` when `rpID` is set and a wildcard in `baseURL.allowedHosts` covers it. `userVerification` now also applies to authentication.

## Workarounds

None verified beyond upgrading.

## Technical details

The registration and authentication handlers passed the request's origin to WebAuthn verification and did not set the required user verification flag. They now use the configured origin and require the user verification flag when `userVerification` is `"required"`.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_