better-auth before 1.1.16 Reflected XSS via error parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-71404 · Microsoft / collected KEV context

EUVD-2025-210583

GHSA-ch2q-47vm-cxgf

GHSA-9x4v-xfq5-m8x5

cve-program · CVE-2025-71404

• https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5
• https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c
• https://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter

euvd · EUVD-2025-210583

• https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5
• https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c
• https://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter

nvd · CVE-2025-71404

• https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c
• https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5
• https://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter

osv · GHSA-9x4v-xfq5-m8x5

• https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5
• https://github.com/better-auth/better-auth/commit/7ae340e2eddad641b7e43d24d37c58a66ce9ddcf
• https://github.com/better-auth/better-auth
• https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81

No related operational record is retained in the current change model.