# CVE-2025-71404: Better Auth reflected cross-site scripting in error page

Source: https://junglewise.ai/threats/cve-2025-71404-better-auth-reflected-cross-site-scripting-in-error-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-71404 · Severity: medium · CVSS 4 · Published 2026-08-01

Better Auth is an authentication library used in web applications to handle user login and session management. The /api/auth/error page fails to sanitize a URL parameter before displaying it on the page, allowing attackers to inject malicious JavaScript code. An attacker could trick users into clicking a specially crafted link, which would execute arbitrary code in their browser and steal session data or perform actions on their behalf.

Technologies: [better-auth (npm)](https://junglewise.ai/threats/technologies/better-auth). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-71404 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71404 being exploited in the wild.

**How severe is CVE-2025-71404?** Medium severity, with a CVSS score of 4, published 1 August 2026.

**Which products and versions are affected?** better-auth (npm) SEMVER:introduced=0.0.2,fixed=1.1.16.

**Is there a fix for CVE-2025-71404?** Yes. better-auth (npm): upgrade to 1.1.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71404 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-71404?** Check whether you run better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- better-auth (npm): upgrade to 1.1.16 or later

  ```sh
  npm install better-auth@1.1.16
  ```


## Technical details

This is a reflected cross-site scripting (XSS) vulnerability in Better Auth's error handling endpoint. The vulnerable component is the /api/auth/error page, which directly reflects the unsanitized error URL parameter as HTML in the error code display on line 81 of error.ts. The attack requires network reachability and user interaction (the user must visit an attacker-crafted URL), but no authentication or elevated privileges are needed. An attacker can execute arbitrary JavaScript in the victim's browser context, potentially compromising session tokens or performing unauthorized actions. The vulnerability was fixed in version 1.1.16 by sanitizing the query parameter before rendering it as HTML.

## Affected products

- Better Auth better-auth >= 0.0.2, < 1.1.16

## Identifiers

- CVE-2025-71404
- GHSA-9x4v-xfq5-m8x5

## Timeline

- 2025-02-05: disclosed
- 2025-02-05: patched: Fixed in version 1.1.16

## References

- [https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5](https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5)
- [https://github.com/better-auth/better-auth/commit/7ae340e2eddad641b7e43d24d37c58a66ce9ddcf](https://github.com/better-auth/better-auth/commit/7ae340e2eddad641b7e43d24d37c58a66ce9ddcf)

## Related threats

- [Better Auth authentication bypass in Magic Link and OAuth](https://junglewise.ai/threats/cve-2026-114607-better-auth-is-an-authentication-and-authorization-library-for)
- [Better Auth OAuth Proxy authentication bypass](https://junglewise.ai/threats/cve-2026-110864-better-auth-from-1-5-0-beta-12-before-1-7-7-contains-an)
- [Better Auth authentication bypass via OAuth state reuse](https://junglewise.ai/threats/cve-2026-110862-better-auth-from-1-4-0-beta-18-before-1-7-7-contains-an)
- [@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL](https://junglewise.ai/threats/cve-2026-110861-better-auth-better-auth-drizzle-adapter-and-better-auth-from-1-6)
- [better-auth device authorization UI misrepresentation in deviceAuthorization plugin](https://junglewise.ai/threats/cve-2026-109346-better-auth-from-1-3-8-beta-3-before-1-7-0-rc-3-contains-a-ui)