---
id: CVE-2025-71402
title: >-
  better-auth versions greater than 1.3.34 and before 1.4.0 contain a
  vulnerability in the multi-session plugin's /sign-out after-hook, which trusts
  raw multi-session cookies and forwards extracted values to
  internalAdapter.deleteSessions …
summary: >-
  better-auth versions greater than 1.3.34 and before 1.4.0 contain a
  vulnerability in the multi-session plugin's /sign-out after-hook, which trusts
  raw multi-session cookies and forwards extracted values to
  internalAdapter.deleteSessions …
severity: none
cwe:
  - CWE-347
published: '2026-08-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:34:34.997'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71402'
references:
  - url: >-
      https://github.com/better-auth/better-auth/security/advisories/GHSA-wmjr-v86c-m9jj
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/better-auth-before-session-revocation-via-forged-cookie
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00206
epssPercentile: 0.11061
ingestedAt: '2026-08-02T05:17:48.746Z'
---

## Overview

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.