Is CVE-2025-71404 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-71404 being exploited in the wild.

How severe is CVE-2025-71404?

Medium severity, with a CVSS score of 4, published 1 August 2026.

Which products and versions are affected?

better-auth (npm) SEMVER:introduced=0.0.2,fixed=1.1.16.

Is there a fix for CVE-2025-71404?

Yes. better-auth (npm): upgrade to 1.1.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-71404 attacked?

It is attacked over the network.

Am I affected by CVE-2025-71404?

Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-71404: Better Auth reflected cross-site scripting in error page

CVE-2025-71404 · Severity: medium · CVSS 4 · Published 2026-08-01

Better Auth is an authentication library used in web applications to handle user login and session management. The /api/auth/error page fails to sanitize a URL parameter before displaying it on the page, allowing attackers to inject malicious JavaScript code. An attacker could trick users into clicking a specially crafted link, which would execute arbitrary code in their browser and steal session data or perform actions on their behalf.

Technologies: better-auth (npm). Vendors: npm.

Quick answers

Is CVE-2025-71404 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-71404 being exploited in the wild.
How severe is CVE-2025-71404?: Medium severity, with a CVSS score of 4, published 1 August 2026.
Which products and versions are affected?: better-auth (npm) SEMVER:introduced=0.0.2,fixed=1.1.16.
Is there a fix for CVE-2025-71404?: Yes. better-auth (npm): upgrade to 1.1.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71404 attacked?: It is attacked over the network.
Am I affected by CVE-2025-71404?: Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

better-auth (npm): upgrade to 1.1.16 or later
```
npm install better-auth@1.1.16
```

Technical details

This is a reflected cross-site scripting (XSS) vulnerability in Better Auth's error handling endpoint. The vulnerable component is the /api/auth/error page, which directly reflects the unsanitized error URL parameter as HTML in the error code display on line 81 of error.ts. The attack requires network reachability and user interaction (the user must visit an attacker-crafted URL), but no authentication or elevated privileges are needed. An attacker can execute arbitrary JavaScript in the victim's browser context, potentially compromising session tokens or performing unauthorized actions. The vulnerability was fixed in version 1.1.16 by sanitizing the query parameter before rendering it as HTML.

Affected products

Better Auth better-auth >= 0.0.2, < 1.1.16

Identifiers

CVE-2025-71404
GHSA-9x4v-xfq5-m8x5

Timeline

2025-02-05: disclosed
2025-02-05: patched: Fixed in version 1.1.16

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.