From 7aa296e6cb0cb430de349ddeb4d5c22cfdd00e2a Mon Sep 17 00:00:00 2001
From: Bereket Engida <86073083+Bekacru@users.noreply.github.com>
Date: Fri, 14 Nov 2025 20:12:32 -0800
Subject: [PATCH] fix(haveibeenpwned): check for limited set of paths (#5998)

---
 .../src/plugins/haveibeenpwned/index.ts       | 24 ++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/packages/better-auth/src/plugins/haveibeenpwned/index.ts b/packages/better-auth/src/plugins/haveibeenpwned/index.ts
index f1d6b25a29..fe3de044e5 100644
--- a/packages/better-auth/src/plugins/haveibeenpwned/index.ts
+++ b/packages/better-auth/src/plugins/haveibeenpwned/index.ts
@@ -1,4 +1,5 @@
 import type { BetterAuthPlugin } from "@better-auth/core";
+import { getCurrentAuthContext } from "@better-auth/core/context";
 import { defineErrorCodes } from "@better-auth/core/utils";
 import { createHash } from "@better-auth/utils/hash";
 import { betterFetch } from "@better-fetch/fetch";
@@ -57,10 +58,22 @@ async function checkPasswordCompromise(
 
 export interface HaveIBeenPwnedOptions {
 	customPasswordCompromisedMessage?: string | undefined;
+	/**
+	 * Paths to check for password
+	 *
+	 * @default ["/sign-up/email", "/change-password", "/reset-password"]
+	 */
+	paths?: string[];
 }
 
-export const haveIBeenPwned = (options?: HaveIBeenPwnedOptions | undefined) =>
-	({
+export const haveIBeenPwned = (options?: HaveIBeenPwnedOptions | undefined) => {
+	const paths = options?.paths || [
+		"/sign-up/email",
+		"/change-password",
+		"/reset-password",
+	];
+
+	return {
 		id: "haveIBeenPwned",
 		init(ctx) {
 			return {
@@ -68,6 +81,10 @@ export const haveIBeenPwned = (options?: HaveIBeenPwnedOptions | undefined) =>
 					password: {
 						...ctx.password,
 						async hash(password) {
+							const c = await getCurrentAuthContext();
+							if (!c.path || !paths.includes(c.path)) {
+								return ctx.password.hash(password);
+							}
 							await checkPasswordCompromise(
 								password,
 								options?.customPasswordCompromisedMessage,
@@ -79,4 +96,5 @@ export const haveIBeenPwned = (options?: HaveIBeenPwnedOptions | undefined) =>
 			};
 		},
 		$ERROR_CODES: ERROR_CODES,
-	}) satisfies BetterAuthPlugin;
+	} satisfies BetterAuthPlugin;
+};