GitHub Advisoryadvisory · npm
GHSA-9x4v-xfq5-m8x5 Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)
MEDIUM
Official page ↗
- Ecosystem
- npm
- Packages
- better-auth
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-79
- Reviewed
- 2025-02-05
Affected packages
• npm better-auth: >= 0.0.2, < 1.1.16 → fixed in 1.1.16
Description
Summary
The better-auth `/api/auth/error` page was vulnerable to HTML injection, resulting in a reflected cross-site scripting (XSS) vulnerability.
Details
The value of `error` URL parameter was reflected as HTML on the error page: https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81
Impact
An attacker who exploited this vulnerability by coercing a user to visit a specially-crafted URL could execute arbitrary JavaScript in the context of the user's browser.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/better-auth/better-auth/security/advisories/GHSA-9x4v-xfq5-m8x5 web
- https://github.com/better-auth/better-auth/commit/7ae340e2eddad641b7e43d24d37c58a66ce9ddcf web
- https://github.com/better-auth/better-auth package
- https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81 web