{"id":"EUVD-2025-210583","revision":"d13da87f7e424e2c9726d4e59fdee499","records":[{"revision":"d13da87f7e424e2c9726d4e59fdee499","observedAt":"2026-11-03T02:13:52.958+00:00","statement":{"source":"euvd","id":"EUVD-2025-210583","aliases":["CVE-2025-71404","GHSA-ch2q-47vm-cxgf"],"title":"better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. A…","description":"better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.1,"severity":null}],"references":["https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5","https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c","https://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-210583","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 1, 2026, 12:22:17 PM","dateUpdated":"Aug 3, 2026, 3:38:00 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-210583","identifiers":["EUVD-2025-210583","CVE-2025-71404","GHSA-ch2q-47vm-cxgf"]},"retained":false,"historicalAffected":[]}],"coverage":[]}