CVE-2025-71404 better-auth CVE debrief

Who should care

Defenders responsible for applications using better-auth versions after v0.0.2 and before 1.1.16 should assess exposure and apply the patch. This includes developers, security teams, and IT professionals managing web applications that utilize better-auth for authentication.

Why it matters

CVE-2025-71404 is a reflected XSS vulnerability in better-auth that allows for arbitrary JavaScript execution. Defenders should prioritize verifying exposure, applying the patch, and monitoring for suspicious activity.

• Arbitrary JavaScript execution in the context of a user's browser
• Potential for phishing and social engineering attacks
• Possible theft of sensitive information
• Defacement or manipulation of web pages

Technical summary

The better-auth library, used for authentication, contains a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page. The vulnerability arises from the 'error' URL parameter being reflected as HTML without proper neutralization, allowing an attacker to execute arbitrary JavaScript in the context of a user's browser if they can coerce the user into visiting a specially-crafted URL.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for arbitrary JavaScript execution in the context of a user's browser.

Recommended defensive actions

• Verify if better-auth versions after v0.0.2 and before 1.1.16 are in use and apply the patch to update to version 1.1.16
• Review and restrict usage of the /api/auth/error page to minimize exposure
• Monitor for suspicious activity related to the /api/auth/error page
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its existence in better-auth versions after v0.0.2 and before 1.1.16, and the fix in version 1.1.16. The vulnerability allows for arbitrary JavaScript execution in the context of a user's browser if an attacker can coerce the user into visiting a specially-crafted URL. Defenders should verify exposure, apply the patch, and monitor for suspicious activity. The source details are limited, and defenders should exercise caution when verifying exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.