diff --git a/advisories/unreviewed/2025/02/GHSA-2cj2-qqxj-5m3r/GHSA-2cj2-qqxj-5m3r.json b/advisories/github-reviewed/2025/02/GHSA-2cj2-qqxj-5m3r/GHSA-2cj2-qqxj-5m3r.json
similarity index 67%
rename from advisories/unreviewed/2025/02/GHSA-2cj2-qqxj-5m3r/GHSA-2cj2-qqxj-5m3r.json
rename to advisories/github-reviewed/2025/02/GHSA-2cj2-qqxj-5m3r/GHSA-2cj2-qqxj-5m3r.json
index 4574223adcf..f3ce4e1c9a7 100644
--- a/advisories/unreviewed/2025/02/GHSA-2cj2-qqxj-5m3r/GHSA-2cj2-qqxj-5m3r.json
+++ b/advisories/github-reviewed/2025/02/GHSA-2cj2-qqxj-5m3r/GHSA-2cj2-qqxj-5m3r.json
@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2cj2-qqxj-5m3r",
-  "modified": "2025-02-24T18:32:42Z",
+  "modified": "2025-02-24T20:49:38Z",
   "published": "2025-02-24T18:32:42Z",
   "aliases": [
     "CVE-2025-26803"
   ],
+  "summary": "Phusion Passenger denial of service ",
   "details": "The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.",
   "severity": [
     {
@@ -13,7 +14,27 @@
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "passenger"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "6.0.21"
+            },
+            {
+              "fixed": "6.0.26"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -27,6 +48,10 @@
       "type": "WEB",
       "url": "https://blog.phusion.nl/2025/02/19/passenger-6-0-26"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/phusion/passenger"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/phusion/passenger/compare/release-6.0.25...release-6.0.26"
@@ -45,8 +70,8 @@
       "CWE-908"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-24T20:49:38Z",
     "nvd_published_at": "2025-02-24T16:15:15Z"
   }
 }
\ No newline at end of file
diff --git a/advisories/github-reviewed/2025/02/GHSA-vp58-j275-797x/GHSA-vp58-j275-797x.json b/advisories/github-reviewed/2025/02/GHSA-vp58-j275-797x/GHSA-vp58-j275-797x.json
new file mode 100644
index 00000000000..8911f35b80a
--- /dev/null
+++ b/advisories/github-reviewed/2025/02/GHSA-vp58-j275-797x/GHSA-vp58-j275-797x.json
@@ -0,0 +1,66 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vp58-j275-797x",
+  "modified": "2025-02-24T20:49:50Z",
+  "published": "2025-02-24T20:49:50Z",
+  "aliases": [],
+  "summary": "Better Auth allows bypassing the trustedOrigins Protection which leads to ATO",
+  "details": "### Summary\nA bypass was found for the security feature **trustedOrigins**. This works for wild card or absolute URLs trustedOrigins configs and opens the victims website to a **Open Redirect** vulnerability, where it can be used to steal the **reset password token** of a victims account by changing the \"callbackURL\" parameter value to a website owned by the attacker.\n\n### Details\n\n#### Absolute URLs\n\nThe issue here appears in the **middleware**,  [specifically](https://github.com/better-auth/better-auth/blob/ddebd0358d74376ea64541512d0167dd4377f182/packages/better-auth/src/api/middlewares/origin-check.ts#L53). This protection is not sufficiente and it allows attackers to get a open redirect, by using the payload `/\\/example.com`. We can check this is a valid URL ( or it will be a valid URL because the URL parser fix it for us ), by checking the image bellow:\n\n![image](https://github.com/user-attachments/assets/d192f06d-358d-4612-97d9-cab89ba55b06)\n\n```typescript\n// trustedOrigins = [ \"https://example.com\" ]\nvalidateURL(\"https://attacker.com\", \"callbackURL\") // ❌ APIError, No Redirect\nvalidateURL(\"/\\/attacker.com\", \"callbackURL\")       // ✅ Redirect to http://attacker.com\n```\n\n#### Regex\n\nThe issue here is because the regex is not strong enough `[^/\\\\]*?\\.example\\.com[/\\\\]*?` ( this is the regex it will be created if we have a wildcard as config ), but we can bypass by using a payload like:\n\n```text\n// trustedOrigins = [ \"*.example.com\" ]\n  ┌──────────────────┐       ┌────────────────┐       ┌─────────────────┐\n  │ None of [ \"/\\\" ] │ ────▶ │ \".example.com\" │ ────▶ │ One of [ \"/\\\" ] │\n  └──────────────────┘       └────────────────┘       └─────────────────┘\n          demo                  .example.com                    /               ✅ Redirect to https://example.com\n          demo                  .attacker.com                   /               ❌ APIError, no redirect\n   http:attacker.com?           .example.com                    /               ✅ Redirect to http://attacker.com\n````\n\nThis works because **:** and **?** are special chars in a URL, so when the URL parser sees, **http:** it will fix our happily fix our URL to http://attacker.com? and make  `.example.com` as parameter, thus, bypassing this check\n\n### PoC\nWe can PoC the open redirect by using the `demo.better-auth.com`. \nIf we access the URL bellow, we are redirected to example.com:\n- https://demo.better-auth.com/api/auth/reset-password/x?callbackURL=/\\/example.com\n\n### Impact\nEvery single website using the **better-auth** library, is vulnerable to un-auth open redirect and more importantilly, vulnerable to potential one click account take over vulnerability, as the attacker can send the victim a email to reset their account while changing the \"redirectTo\" parameter [here](https://demo.better-auth.com/forget-password), and when the victim clicks on the link, the reset token is sent to the attackers website, thus making the attacker to use the token stolen and reset the password of the victim.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "better-auth"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.1.21"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 1.1.20"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-vp58-j275-797x"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/better-auth/better-auth/commit/b381cac7aafd6aa53ef78b6ab771ebfa24643c80"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/better-auth/better-auth"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/better-auth/better-auth/blob/ddebd0358d74376ea64541512d0167dd4377f182/packages/better-auth/src/api/middlewares/origin-check.ts#L53"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-601"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-02-24T20:49:50Z",
+    "nvd_published_at": null
+  }
+}
\ No newline at end of file