CVE-2025-71404 in better-auth
Summary
by MITRE • 08/01/2026
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/01/2026
This vulnerability exists within the better-auth authentication library where the /api/auth/error endpoint fails to properly sanitize user input from the error URL parameter. The reflected cross-site scripting flaw occurs when an attacker crafts a malicious URL containing arbitrary JavaScript code within the error parameter, which is then reflected back to the victim's browser without adequate HTML escaping or encoding. This type of vulnerability falls under CWE-79 which categorizes improper neutralization of input during web page generation as a critical web application security weakness. The attack vector leverages social engineering tactics where an attacker persuades a user to click on a malicious link, triggering the XSS payload execution within the victim's browser context.
The technical implementation of this vulnerability stems from the library's failure to implement proper input validation and output encoding mechanisms when processing the error parameter. When the authentication system redirects users to the error page with the raw error message from the URL parameter, it creates an opportunity for attackers to inject malicious scripts that execute in the victim's browser session. This allows for a range of potential attacks including session hijacking, credential theft, and malicious redirection. The vulnerability affects all versions between v0.0.2 and 1.1.16, indicating a prolonged period where applications using this library were exposed to potential exploitation.
The operational impact of this vulnerability extends beyond simple script execution as it can enable attackers to establish persistent access to user sessions through session token theft or manipulation. Users who visit malicious URLs may unknowingly have their browser cookies and authentication tokens compromised, potentially allowing attackers to impersonate legitimate users within the application. This represents a significant risk for applications that rely on better-auth for user authentication and authorization management.
Mitigation strategies should include immediate upgrading to version 1.1.16 or later where the vulnerability has been addressed through proper input sanitization of URL parameters. Additionally, implementing Content Security Policy headers can provide defense-in-depth protection against XSS attacks by restricting script execution sources. The fix should incorporate proper HTML escaping of all user-supplied input before rendering it in web pages, aligning with OWASP top ten recommendations for preventing cross-site scripting vulnerabilities. Organizations should also implement proper input validation at multiple layers including client-side and server-side to ensure comprehensive protection against similar reflected XSS scenarios.