CVE-2025-71404 json
better-auth before 1.1.16 Reflected XSS via error parameter
published 2025-02-05 21 mo ago modified 2026-10-06 33 d ago also EUVD-2025-210583 , GHSA-9x4v-xfq5-m8x5
- cvss
- 5.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.
Patch / fix
- npm better-auth 1.1.16
- better-auth better-auth 1.1.16
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | better-auth | >=0.0.2, <1.1.16 |
1.1.16 |
Affected products
- better-auth better-auth
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c
patch
-
github.com
/better-auth/better-auth/commit/7ae340e2eddad641b7e43d24d37c58a66ce9ddcf
web
-
github.com
/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5
vendor-advisory, web
-
vulncheck.com
/advisories/better-auth-before-reflected-xss-via-error-parameter
third-party-advisory
-
github.com
/better-auth/better-auth
package
-
github.com
/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/err
web
Sources
- CVE List CVE-2025-71404
- GitHub Advisory GHSA-9x4v-xfq5-m8x5
- NVD CVE-2025-71404
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.