CVE-2025-71402: better-auth before 1.4.0 Session Revocation via Forged Cookie
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged multi- cookie to trigger deletion of arbitrary session tokens.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
better-authto a version that resolves this vulnerability.Fixed in 1.4.0Patch better-auth before 1.4.0 Session Revocation via Forged Cookie
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71402?
The severity of CVE-2025-71402 is rated low with a score of 2.
How do I fix CVE-2025-71402?
To fix CVE-2025-71402, upgrade to better-auth version 1.4.0 or later.
What is the risk associated with CVE-2025-71402?
CVE-2025-71402 has a risk score of 27, indicating its potential impact.
What software is affected by CVE-2025-71402?
CVE-2025-71402 affects versions of better-auth greater than 1.3.34 and before 1.4.0.
What type of vulnerability is CVE-2025-71402?
CVE-2025-71402 is a vulnerability in the session revocation process due to a forged cookie.