CVE-2025-71404
Received Received - Intake

Reflected XSS in Better Auth

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2025-71404
EUVD
EUVD-2025-210583

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
better-auth better-auth From 0.0.2 (exc) to 1.1.16 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in better-auth versions after v0.0.2 and before 1.1.16. The /api/auth/error page reflects the 'error' URL parameter as HTML without proper neutralization, allowing attackers to execute arbitrary JavaScript in a user's browser by tricking them into visiting a malicious URL.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the /api/auth/error endpoint for URLs containing the 'error' parameter with untrusted input. Check if the parameter value is reflected in the HTML response without proper escaping. Use tools like curl to test: curl 'http://target.com/api/auth/error?error=<script>alert(1)</script>' and inspect if the script executes.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or redirect you to phishing sites. If you use a vulnerable version of better-auth, visiting a crafted link could lead to unauthorized access to your account or data.

Mitigation Strategies

Immediately update better-auth to version 1.1.16 or later to patch the XSS vulnerability. If an update is not immediately possible, implement input validation and output encoding for the 'error' parameter on the /api/auth/error page to neutralize HTML special characters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71404. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart