fix(deps): update dependency better-auth to v1.1.16 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
better-auth (source)	1.1.15 -> 1.1.16

GitHub Vulnerability Alerts

GHSA-9x4v-xfq5-m8x5

Summary

The better-auth /api/auth/error page was vulnerable to HTML injection, resulting in a reflected cross-site scripting (XSS) vulnerability.

Details

The value of error URL parameter was reflected as HTML on the error page: https://github.com/better-auth/better-auth/blob/05ada0b79dbcac93cc04ceb79b23ca598d07830c/packages/better-auth/src/api/routes/error.ts#L81

PoC

https://demo.better-auth.com/api/auth/error?error=%3Cscript%3Ealert(1)%3C/script%3E

Impact

An attacker who exploited this vulnerability by coercing a user to visit a specially-crafted URL could execute arbitrary JavaScript in the context of the user's browser.

Because better-auth is a dependency of web applications, the impact of such a vulnerability is unknowable; it depends on the functionality of the application/site using better-auth. I have calculated the CVSS score assuming the hypothetical victim is an administrator with elevated permissions and access.

---

Release Notes

better-auth/better-auth (better-auth)

v1.1.16

Compare Source

   🚀 Features

• Add cookie helper for middlewares  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1275 (2eca1)
• Add refetch function for all client hooks  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1206 (05afc)

   🐞 Bug Fixes

• Trigger session update on delete user  -  by @​Bekacru (0df2b)
• Handle converting date on session parsing from cookie cache  -  by @​Bekacru in https://github.com/better-auth/better-auth/issues/1342 (90064)
• Google IdToken auth issuer mismatch  -  by @​abegehr in https://github.com/better-auth/better-auth/issues/1351 (e83c0)
• Make session table optional when secondary storage is provided  -  by @​Bekacru (4c2ef)
• anonymous:
  • Add sign-up route to linking matcher  -  by @​Bekacru (6e659)
  • Link account user and session type should be less strict  -  by @​Bekacru (2cb80)
• drizzle:
  • Incorrect call to getModelName  -  by @​chrnorm in https://github.com/better-auth/better-auth/issues/1329 (9a3e2)
  • Drizzle adapter failing to return data on create and update when using mysql  -  by @​Kinfe123 in https://github.com/better-auth/better-auth/issues/1358 (4748b)
• oidc:
  • Missing content type header on openId configuration endpoint  -  by @​Bekacru (cb91d)
• passkey:
  • Use options base url for rpID  -  by @​Bekacru (2da63)
• security:
  • Santize query param on error page  -  by @​Bekacru (7ae34)

    View changes on GitHub

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
shiro	❌ Failed (Inspect)			Feb 6, 2025 1:11am