Unauthenticated better-auth API Key Request (CVE-2025-61928)

michael lohn@mlohn1984

•updated Feb 19, 2026•6•0•74

Detects successful POST requests to better-auth API key creation or update endpoints that appear to be unauthenticated. This pattern is indicative of exploitation of CVE-2025-61928, where an attacker can create or modify API keys for any user without a valid session.