{"id":"CVE-2025-71402","title":"better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions …","summary":"better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions …","severity":"none","cwe":["CWE-347"],"published":"2026-08-01","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:34:34.997","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71402","references":[{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-wmjr-v86c-m9jj","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/better-auth-before-session-revocation-via-forged-cookie","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00206,"epssPercentile":0.11055,"ingestedAt":"2026-08-02T05:17:48.746Z","slug":"CVE-2025-71402","body":"## Overview\n\nbetter-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}