{"id":"CVE-2025-71402","aliases":["GHSA-wmjr-v86c-m9jj"],"url":"https://o3.security/vulnerability/CVE-2025-71402","summary":"better-auth before 1.4.0 Session Revocation via Forged Cookie","details":"better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.","published":"2026-08-01T12:22:16.655Z","modified":"2026-09-10T03:30:17.709293826Z","cvss":null,"epss":{"score":0.00206,"percentile":0.10866,"asOf":"2026-08-04"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"better-auth","fixedVersion":"1.4.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71402.json"},{"type":"ADVISORY","url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-wmjr-v86c-m9jj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71402"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/better-auth-before-session-revocation-via-forged-cookie"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:30:17.709293826Z"}}