CVE-2025-71404 better-auth CVE debrief

Who should care

Developers and administrators using better-auth versions after v0.0.2 and before 1.1.16 should review and apply the patched version 1.1.16 or later. Security teams and vulnerability management teams should prioritize this vulnerability due to its potential impact on web application security. Operators of systems using affected better-auth versions should also be aware of the vulnerability and take steps to mitigate it. IT teams responsible for maintaining and securing web applications that utilize the better-auth library should take immediate action to protect against potential XSS attacks.

Technical summary

The better-auth library versions after v0.0.2 and before 1.1.16 contain a reflected cross-site scripting (XSS) vulnerability on the /api/auth/error page. The value of the 'error' URL parameter is reflected as HTML without proper neutralization, allowing an attacker to execute arbitrary JavaScript in the context of the user's browser. This vulnerability can be exploited by coercing a user into visiting a specially-crafted URL. The issue is fixed in version 1.1.16. Security teams should prioritize this vulnerability due to its potential impact on web application security. Operators of systems using affected better-auth versions should also be aware of the vulnerability and take steps to mitigate it.

Defensive priority

Medium-priority defensive review recommended due to reflected XSS vulnerability in better-auth versions after v0.0.2 and before 1.1.16.

Recommended defensive actions

• Review and apply version 1.1.16 or later of better-auth
• Inventory and monitor systems using affected better-auth versions
• Implement compensating controls for input validation and output encoding
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from official CVE and NVD sources indicates a reflected cross-site scripting (XSS) vulnerability in better-auth versions after v0.0.2 and before 1.1.16. Limited detail available on attack scenarios and affected systems. Defenders should verify system configurations, review logs for suspicious activity, and monitor for potential exploitation attempts.

Official resources