CVE-2025-71404: better-auth Reflected XSS Vulnerability

CVE-2025-71404 Overview

CVE-2025-71404 is a reflected cross-site scripting (XSS) vulnerability in the better-auth authentication library. Versions after v0.0.2 and before 1.1.16 reflect the value of the error URL parameter on the /api/auth/error page as HTML without proper neutralization. An attacker who convinces a user to visit a crafted URL can execute arbitrary JavaScript in the victim's browser under the origin of the vulnerable application. The issue is fixed in version 1.1.16 and is tracked under [CWE-79].

Critical Impact
Successful exploitation lets attackers execute arbitrary JavaScript in the authenticated user's browser context, enabling session theft, credential harvesting, and account takeover on applications built with vulnerable better-auth releases.

Affected Products

better-auth versions after v0.0.2
better-auth versions before 1.1.16
Applications embedding the /api/auth/error endpoint

Discovery Timeline

2026-08-01 - CVE-2025-71404 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2025-71404

Vulnerability Analysis

The vulnerability lives in the /api/auth/error route handler shipped by better-auth. When the endpoint receives a request, it reads the error query-string parameter and embeds the value directly into the HTML response. Because the library does not HTML-encode or otherwise neutralize the input, any markup or <script> payload placed in the parameter is rendered by the browser as active content.

Exploitation follows the standard reflected XSS pattern. An attacker crafts a URL such as https://victim.example/api/auth/error?error=<script>...</script> and delivers it through phishing, chat, or an embedded link. When a user opens the URL, the injected script runs with the privileges of the victim's session on the target origin. This allows theft of authentication cookies, session tokens managed by better-auth, and any locally accessible identity data.

Root Cause

The root cause is missing output encoding on a user-controlled request parameter. The error value is concatenated into the response body of the error page instead of being rendered through a context-aware escaping routine. [CWE-79] classifies this as improper neutralization of input during web page generation.

Attack Vector

The attack is network-based and requires user interaction. The attacker must lure a target into clicking or loading a specially crafted URL containing a malicious error payload. No authentication or elevated privileges are required to trigger the reflection. Because better-auth handles authentication flows, a successful payload frequently lands on a page where identity cookies and CSRF tokens are already scoped, increasing the value of the stolen data.

A detailed advisory is available in the GitHub Security Advisory GHSA-9x4v-xfq5-m8x5 and the VulnCheck Advisory on XSS. The corresponding upstream change set is referenced in the GitHub Commit Update.

Detection Methods for CVE-2025-71404

Indicators of Compromise

Web server access logs containing requests to /api/auth/error with error parameter values that include <, >, script, onerror=, javascript:, or URL-encoded equivalents such as %3Cscript%3E.
Referrers pointing to external phishing or link-shortener domains preceding requests to /api/auth/error.
Unusual outbound requests from browsers to attacker-controlled domains immediately after a user visits an error page.

Detection Strategies

Add a Web Application Firewall (WAF) rule that inspects the error query parameter on /api/auth/error and blocks payloads containing HTML tag characters or common XSS keywords.
Deploy Content Security Policy (CSP) reporting to capture blocked inline script executions and forward violation reports to a monitoring pipeline.
Correlate authentication anomalies — session reuse from new IPs, sudden token refresh spikes — with recent hits on /api/auth/error.

Monitoring Recommendations

Track the frequency of /api/auth/error requests and alert on statistical spikes tied to specific referrers or user agents.
Log the full URL and normalized error parameter value for every request to the endpoint for at least 90 days.
Monitor for better-auth package versions in software bill of materials (SBOM) scans and flag any deployment below 1.1.16.

How to Mitigate CVE-2025-71404

Immediate Actions Required

Upgrade better-auth to version 1.1.16 or later across all applications and services.
Audit application dependency manifests (package.json, pnpm-lock.yaml, yarn.lock) to confirm the resolved version is patched.
Invalidate active user sessions if suspicious traffic against /api/auth/error is present in historical logs.

Patch Information

The fix is available in better-auth version 1.1.16. Upstream changes are tracked in the GitHub Security Advisory GHSA-9x4v-xfq5-m8x5 and the related GitHub Commit Update. Because the linked commit references UI theme components rather than the /api/auth/error handler itself, review the security advisory for the authoritative code fix before backporting.

Workarounds

Deploy a reverse-proxy or WAF rule that strips or rejects HTML metacharacters in the error query parameter for /api/auth/error.
Enforce a strict Content Security Policy that disallows inline scripts (script-src 'self') to blunt exploitation until the patch is applied.
Temporarily disable or redirect the /api/auth/error route to a static error page if upgrading immediately is not feasible.

bash

# Upgrade better-auth to the patched release
npm install better-auth@1.1.16

# Verify the resolved version
npm ls better-auth

# Example CSP header to reduce reflected XSS impact
# Add to your web server or framework middleware
#   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'