{"id":"EUVD-2025-210583","enisaUuid":"00dcf323-074f-3f17-8802-8a56af8493cf","description":"better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the \u0027error\u0027 URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user\u0027s browser. The issue is fixed in version 1.1.16.","datePublished":"Aug 1, 2026, 12:22:17 PM","dateUpdated":"Aug 3, 2026, 3:38:00 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5\nhttps://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c\nhttps://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter\n","aliases":"CVE-2025-71404\nGHSA-ch2q-47vm-cxgf\n","assigner":"VulnCheck","epss":0.72,"enisaIdProduct":[{"id":"f5f3cedd-cd29-3fc3-99d0-b091b7d1a9ce","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"0 \u003c1.1.16"}],"enisaIdVendor":[{"id":"2e98cd46-b00d-3f62-acd4-81fed8778f3a","vendor":{"name":"better-auth"}}],"enisaIdVulnerability":[{"id":"28ecebc5-1471-37cd-b30c-e38591a8fc39","vulnerability":{"id":"GHSA-ch2q-47vm-cxgf","description":"better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the \u0027error\u0027 URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user\u0027s browser. The issue is fixed in version 1.1.16.","datePublished":"Aug 1, 2026, 3:30:23 PM","dateUpdated":"Aug 1, 2026, 3:30:23 PM","baseScore":0.0,"references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71404\nhttps://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c\nhttps://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter\n","enisa_id":"EUVD-2025-210583\n","aliases":"CVE-2025-71404\nGHSA-ch2q-47vm-cxgf\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"dde72239-f0ea-3325-b532-ff70bcb6b776","vulnerability":{"id":"CVE-2025-71404","description":"better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the \u0027error\u0027 URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user\u0027s browser. The issue is fixed in version 1.1.16.","datePublished":"Aug 1, 2026, 12:22:17 PM","dateUpdated":"Aug 3, 2026, 3:38:00 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5\nhttps://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c\nhttps://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter\n","enisa_id":"EUVD-2025-210583\n","assigner":"VulnCheck","epss":0.72,"dataProcessed":"Nov 2, 2026, 7:20:18 AM","vulnerabilityProduct":[{"id":"111305c7-cd27-33c2-88b9-e3ca1ad1c28e","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"0 \u003c1.1.16"}],"vulnerabilityVendor":[{"id":"ce247c6c-1803-3239-b82e-f1ae763d9fe8","vendor":{"name":"better-auth"}}]}}],"enisaIdAdvisory":[]}