Authenticated Users Exploit Insecure Direct Object References in Passkeys

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with enumerated passkey IDs to remove other users' passkeys.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2025-71400 is an insecure direct object reference (IDOR) vulnerability in better-auth passkey versions before 1.4.0 that allows authenticated attackers to delete arbitrary passkeys belonging to other users. By crafting requests to the delete-passkey endpoint with enumerated passkey IDs, threat actors with valid sessions can remove authentication factors from victim accounts without authorization. This vulnerability is particularly critical because passkeys represent a modern, phishing-resistant authentication method; compromising passkey management directly undermines account security and can lead to unauthorized account access, credential compromise, and lateral movement within connected systems.

Casky's 283 mapped skills leverage Claude's extended reasoning to detect the attack patterns behind this CVE across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify findings such as: anomalous delete requests to authentication endpoints from authenticated users targeting passkey IDs outside their own scope; unusual enumeration patterns where sequential or non-sequential passkey IDs are being probed; and privilege escalation indicators where low-privileged users successfully remove authentication factors from high-value accounts. The skills would correlate session activity with object reference manipulation, flagging the classic IDOR signature of direct resource access without proper authorization checks—enabling security teams to detect both active exploitation and reconnaissance activity targeting passkey infrastructure before widespread compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-71400.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2025-71400

Casky has 283 skills that investigate the attack patterns behind CVE-2025-71400. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn