CVE-2025-71404CWE-79cross-site-scripting

CVE-2025-71404

published August 1, 2026

CVSS
5.1
EPSS
1%
Percentile
43.4
In the wild
Unconfirmed
What it is

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00521 · 43.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-01T17:16Z
References (3)
https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c · [email protected]https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5 · [email protected]https://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter · [email protected]
EPSS history
Timeline
  • 01 AUG 12:22Z
    better-auth before 1.1.16 Reflected XSS via error parameter
    cvelistv5