CVE-2025-71402
better-auth before 1.4.0 Session Revocation via Forged Cookie
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.
| CWE | CWE-347 |
| Vendor | better-auth |
| Product | better-auth |
| Published | Aug 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for better-auth better-auth
Be the first to know when new unknown vulnerabilities affecting better-auth better-auth are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
better-auth / better-auth
0 < 1.4.0
References
Credits
mufeedvh