better‑auth versions after v0.0.2 and before 1.1.16 contain a reflected Cross‑Site Scripting vulnerability on the /api/auth/error page, where the value of the error URL parameter is echoed into the page without proper neutralization. A malicious actor who persuades a user to visit a specially crafted link can inject and execute arbitrary JavaScript in the victim’s browser. The vulnerability is a classic CWE‑79 case and can be used to steal session cookies, submit data on behalf of the user, or perform other client‑side attacks while the user remains authenticated within the application’s domain.

The flaw affects all installations of better‑auth, specifically versions later than v0.0.2 up through 1.1.15. The software is delivered as a Node.js-based OAuth provider and runs on any host that supports the Node.js runtime.

The CVSS score of 5.1 categorizes the issue as medium‑severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, indicating no public exploits are known at the time of analysis. The attack requires the victim to click a malicious link or otherwise load a crafted URL in their browser; authentication or privileged access is not required. Given the classic reflected XSS vector, the potential impact is limited to individual users, but the ability to hijack sessions or perform unauthorized actions can be significant if the target application handles sensitive data within the same origin.