CVE-2025-71404

Name of the Vulnerable Software and Affected Versions better-auth versions 0.0.3 through 1.1.15

Description A reflected cross-site scripting (XSS) issue exists on the '/api/auth/error' endpoint. The application reflects the value of the error URL parameter as HTML without proper neutralization, allowing an attacker to execute arbitrary JavaScript in the user's browser by inducing them to visit a specially-crafted URL.

Recommendations Update to version 1.1.16. As a temporary workaround, restrict access to the '/api/auth/error' endpoint or avoid using the error parameter until the update is applied.