https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T20:34:50.224185+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/ghsa-9x4v-xfq5-m8x5 GHSA-9x4v-xfq5-m8x5 — Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting) 2026-10-06T20:34:50.225920+00:00

Affected: npm: better-auth

### Summary The better-auth `/api/auth/error` page was vulnerable to HTML injection, resulting in a reflected cross-site scripting (XSS) vulnerability.

### Details The value of `error` URL parameter was reflected as HTML on the error page: https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81

### Impact An attacker who exploited this vulnerability by coercing a user to visit a specially-crafted URL could execute arbitrary JavaScript in the context of the user's browser.