Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck

CVE-2025-71404better-auth before 1.1.16 Reflected XSS via error parameter

Medium 5.1

In plain English

A medium-severity cross-site scripting in better-auth from better-auth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.7%top 45.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	better-auth	1.1.16	GHSA-9x4v-xfq5-m8x5

Affected products (as reported)

Vendor	Product	Versions
better-auth	better-auth	0 – before 1.1.16

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-9x4v-xfq5-m8x5) vendor-advisory
Patch Commit patch
VulnCheck Advisory: better-auth before 1.1.16 Reflected XSS via error parameter third-party-advisory