PT-2025-5821 · Unknown · Better Auth

Published 2025-02-05 · Updated 2025-02-05

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: better-auth (affected versions not specified)

Description: The better-auth /api/auth/error page is vulnerable to HTML injection, resulting in a reflected cross-site scripting (XSS) issue. The error URL parameter's value is reflected as HTML on the error page. An attacker could exploit this by coercing a user to visit a specially-crafted URL, allowing the execution of arbitrary JavaScript in the context of the user's browser. The impact depends on the functionality of the application using better-auth.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-9X4V-XFQ5-M8X5

Affected Products

Better Auth

References · 5

• https://osv.dev/vulnerability/GHSA-9x4v-xfq5-m8x5 · Vendor Advisory
• https://github.com/better-auth/better-auth · Note
• https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81 · Note
• https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5 · Note
• https://github.com/better-auth/better-auth/commit/7ae340e2eddad641b7e43d24d37c58a66ce9ddcf · Note