CVE-2025-71404
mediumPriorität · verfolgen · 0EPSS 0.005 · 44. PerzentilEUUSEPSS · bewertet 2026-10-27
better-auth versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page, where the value of the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker who coerces a user into visiting a specially-crafted URL can execute arbitrary JavaScript in the context of the user's browser. The issue is fixed in version 1.1.16.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 1.2–5.1
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (2)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-9x4v-xfq5-m8x5Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)2025-02-05ghsa · osvUS
### Summary The better-auth `/api/auth/error` page was vulnerable to HTML injection, resulting in a reflected cross-site scripting (XSS) vulnerability. ### Details The value of `error` URL parameter was reflected as HTML on the error page: https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81 ### Impact An attacker who exploited this vulnerability by coercing a user to visit a specially-crafted URL could execute arbitrary JavaScript in the context of the user's browser.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830ccnnvd
- https://github.com/better-auth/better-auth/releasesPatchcnnvd
- https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5cnnvd
- https://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parametercnnvd
- https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830cenisa_euvd
- https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5enisa_euvd
- https://www.vulncheck.com/advisories/better-auth-before-reflected-xss-via-error-parameterenisa_euvd
- https://github.com/better-auth/better-auth/commit/05ada0b79dbcac93cc04ceb79b23ca598d07830cnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan