| Package | Affected versions | Patched versions |
|---|---|---|
| better-auth | ≥ 0.0.2, < 1.1.16 | 1.1.16 |
The better-auth /api/auth/error page was vulnerable to HTML injection, resulting in a reflected cross-site scripting (XSS) vulnerability.
The value of error URL parameter was reflected as HTML on the error page: https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81
An attacker who exploited this vulnerability by coercing a user to visit a specially-crafted URL could execute arbitrary JavaScript in the context of the user's browser.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free