CVE-2025-71402
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature. An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.
Risk Assessment
An attacker can delete other users' sessions, causing logout and potential loss of access to the system.
Recommendation
Update better-auth to version 1.4.0 or later, which includes the fix for cookie signature verification.
Original NVD description (English source)
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.