Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)
Date: 2025-02
Affected: npm/better-auth
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-79

### Summary The better-auth `/api/auth/error` page was vulnerable to HTML injection, resulting in a reflected cross-site scripting (XSS) vulnerability. ### Details The value of `error` URL parameter was reflected as HTML on the error page: https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81 ### Impact An attacker who exploited this vulnerability by coercing a user to visit a specially-crafted URL could execute arbitrary JavaScript in the context of the user's browser.


Mitigations:

Architectural layers (MAESTRO):