© 2026 vulntracker.io

CVE-2025-71404

better-auth before 1.1.16 Reflected XSS via error parameter

MEDIUM

5.1

CVSS Score

Published: August 1, 2026 at 12:22 PM UTC

Updated: October 6, 2026 at 10:10 PM UTC

2 products affected across 1 vendorBetter Auth /oauth ProviderAuth Better Auth

Using better-auth by better-auth?

Get instant alerts when new vulnerabilities affect better-auth - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.1

Exploit prediction

EPSS 0.7%

SSVC

No known exploit

Description

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Better Auth /oauth Provider · Better Auth

95%

v < 1.1.16

Affected range stops below 1.1.16, so it looks safe — our inference, not a vendor statement

Auth Better Auth · Better Authnpm

60%

v < 1.1.16

Vendor states this is fixed in 1.1.16 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

Vendor Advisory

Source: cverecord

https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5

Patch

Source: cverecord

https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830c

Third Party Advisory

Source: cverecord

https://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameter

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.1MEDIUMVulnCheck

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card