{"id":"CVE-2025-71404","title":"better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization…","summary":"better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization…","severity":"none","cwe":["CWE-79"],"published":"2026-08-01","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:34:34.997","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71404","references":[{"url":"https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c","label":"disclosure@vulncheck.com"},{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00399,"epssPercentile":0.33897,"ingestedAt":"2026-08-02T05:17:48.816Z","slug":"CVE-2025-71404","body":"## Overview\n\nbetter-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}