Executive brief
Better Auth is an authentication library used in web applications to handle user login and session management. The /api/auth/error page fails to sanitize a URL parameter before displaying it on the page, allowing attackers to inject malicious JavaScript code. An attacker could trick users into clicking a specially crafted link, which would execute arbitrary code in their browser and steal session data or perform actions on their behalf.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in Better Auth's error handling endpoint. The vulnerable component is the /api/auth/error page, which directly reflects the unsanitized error URL parameter as HTML in the error code display on line 81 of error.ts. The attack requires network reachability and user interaction (the user must visit an attacker-crafted URL), but no authentication or elevated privileges are needed. An attacker can execute arbitrary JavaScript in the victim's browser context, potentially compromising session tokens or performing unauthorized actions. The vulnerability was fixed in version 1.1.16 by sanitizing the query parameter before rendering it as HTML.
Affected products
- Better Auth better-auth >= 0.0.2, < 1.1.16
Timeline
- 2025-02-05: disclosed
- 2025-02-05: patched: Fixed in version 1.1.16