CVE-2025-71402
Received Received - Intake

Authentication Bypass in Better-Auth Multi-Session Plugin

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2025-71402
EUVD
EUVD-2025-210584

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
better-auth better-auth From 1.4.0 (exc) to 1.3.34 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

better-auth versions greater than 1.3.34 and before 1.4.0 have a flaw in the multi-session plugin's /sign-out after-hook. The system trusts raw multi-session cookies and passes extracted values to internalAdapter.deleteSessions without verifying the cookie signature. An attacker can forge a _multi-* cookie to delete arbitrary session tokens.

Impact Analysis

An attacker could exploit this to log users out of their sessions by deleting their session tokens. This could lead to denial of service or forced re-authentication, disrupting legitimate user access.

Mitigation Strategies

Upgrade better-auth to version 1.4.0 or later to address the vulnerability in the multi-session plugin's sign-out hook. Ensure proper cookie signature verification is implemented to prevent forged _multi-* cookies from deleting arbitrary sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71402. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart