EUVD-2025-210583
GHSA-ch2q-47vm-cxgf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no privileges needed; scope changes as injected JS executes in victim browser context; user interaction required to click the crafted link.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.
AnalysisAI
Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser when a user visits an attacker-crafted URL containing a malicious 'error' query parameter that is reflected as unsanitized HTML. All npm releases of better-auth from version 0.0.2 up to (but not including) 1.1.16 are affected, spanning virtually the entire release history of the library. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the attack surface is inherently internet-accessible and requires only social engineering to trigger.
Technical ContextAI
better-auth is an npm authentication framework (cpe:2.3:a:better-auth:better-auth:*:*:*:*:*:*:*:*) that exposes a built-in /api/auth/error HTTP route for surfacing authentication errors to end users. Per GHSA-9x4v-xfq5-m8x5, the vulnerable code at packages/better-auth/src/api/routes/error.ts line 81 interpolates the raw value of the 'error' URL query parameter directly into the HTML response without encoding or sanitization, satisfying CWE-79 (Improper Neutralization of Input During Web Page Generation). Because the parameter is server-reflected rather than stored, the payload is not persisted and must be delivered fresh with each victim request - the classic reflected XSS pattern. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms that no special network position or attack prerequisite is needed beyond inducing a user to follow a link.
RemediationAI
Upgrade the better-auth npm package to version 1.1.16, which is the vendor-confirmed fix version per both GHSA-9x4v-xfq5-m8x5 and ENISA EUVD-2025-210583. The patch is available at https://github.com/better-auth/better-auth/commit/7ae340e2eddad641b7e43d24d37c58a66ce9ddcf. If an immediate upgrade is not feasible, a compensating control is to place a Web Application Firewall rule or reverse proxy filter that strips or encodes angle brackets and script-injection sequences from the 'error' query parameter on requests to /api/auth/error; note this trades off completeness of error messaging and may require ongoing maintenance as bypass techniques evolve. Blocking direct external access to the /api/auth/error path entirely is a more robust workaround where the authentication error page is not required for external users, at the cost of degraded error UX.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-b
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully tak
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromi
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today