Packages / better-auth / Security

ModerateVulnerabilityGHSA-9x4v-xfq5-m8x5CVE-2025-71404Published 5 Feb 2025

Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)

Affected releases · better-auth

  • 1.x1.0.0 – 1.1.15Fixed in 1.1.16
  • 0.8.x and older0.0.2 – 0.8.8No fix, no longer updated

On 1.x, the newest line:

npm install better-auth@1.1.16
1.x

  1. Affected

    1.0.0 – 1.1.15

    38 releases

  2. Fixed

    1.1.16 – 1.7.12

    131 releases, latest

0.x

  1. Not affected

    0.0.1

    1 release

  2. Affected

    0.0.2 – 0.8.8

    60 releases

230 stable releases of better-auth, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for better-auth. It is read in your browser and sent nowhere.

What happens

Summary

The better-auth /api/auth/error page was vulnerable to HTML injection, resulting in a reflected cross-site scripting (XSS) vulnerability.

Details

The value of error URL parameter was reflected as HTML on the error page: github.com/better-auth/better-auth/blob/05ada0b…

Impact

An attacker who exploited this vulnerability by coercing a user to visit a specially-crafted URL could execute arbitrary JavaScript in the context of the user's browser.