Path Normalization Bypass Enables Authentication Security Control Evasion

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Better Auth, a widely-used authentication library, contains a critical path normalization vulnerability in its dependency chain (rou3 router library). By manipulating URL paths with extra slashes (e.g., //path instead of /path), attackers can bypass security controls including disabledPaths configurations and path-based rate limiting mechanisms. This vulnerability affects Better Auth versions prior to 1.4.5 and matters significantly because authentication bypasses directly undermine access control decisions—allowing attackers to reach endpoints that should be restricted, potentially gaining unauthorized access to sensitive functionality or exhausting rate limits to enable denial-of-service attacks.

Casky's 322 matching skills leverage Claude's extended reasoning to detect the sophisticated attack patterns underlying this CVE by analyzing both Initial Access (TA0001) and Persistence (TA0043) techniques. Practitioners using Casky would observe detection findings that flag anomalous URL path patterns with redundant slashes in HTTP requests targeting authentication endpoints, combined with behavioral analysis showing repeated attempts to access disabledPaths or suspicious spike patterns that suggest rate-limit bypass attempts. The platform's Claude-powered analysis correlates CWE-20 (Improper Input Validation) indicators with authentication framework logs, identifying when path normalization differences between client requests and server-side route matching create exploitable gaps. Security teams would see these findings contextualized against their Better Auth version inventory, enabling rapid identification of vulnerable deployments and prioritization of patching efforts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-71399.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2025-71399

Casky has 322 skills that investigate the attack patterns behind CVE-2025-71399. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn