CVE-2025-71404
5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Summary
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| better-auth | better-auth | 0 < 1.1.16 | affected |
| better-auth | better-auth | 1.1.16 | unaffected |
Weaknesses
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5
- https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c
- https://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.