Session Management Flaw in Better-Auth Plugin by Better-Auth
CVE-2025-71402

2LOW

Key Information:

Vendor

Better-auth

Status
Better-auth
Vendor
CVE Published:
1 August 2026

What is CVE-2025-71402?

The Better-Auth multi-session plugin versions greater than 1.3.34 and before 1.4.0 contains a significant vulnerability. This issue arises from the plugin's /sign-out after-hook, which fails to properly validate raw multi-session cookies. An attacker can exploit this vulnerability by submitting a forged _multi-* cookie. If successful, the attacker can trigger the deletion of arbitrary session tokens through internalAdapter.deleteSessions, potentially compromising user sessions without proper authentication checks.

Affected Version(s)

better-auth 0 < 1.4.0

better-auth 1.4.0

References

https://github.com/better-auth/better-auth/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/better-auth-before-s...
third-party-advisory

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mufeedvh
.