Better-auth account takeover (CVE-2025-61928) found via ZeroPath | Not Hacker News!