Summary

Affected versions of the better-auth passkey plugin allow users with any valid session to delete arbitrary passkeys via their ID using POST /passkey/delete-passkey.

Details

ctx.body.id is implicitly trusted and used in passkey deletion queries.

better-auth applications configured with useNumberId may use auto incrementing IDs which makes it trivial to delete all passkeys via enumeration.