CVE-2025-71402 better-auth CVE debrief

Who should care

Users of better-auth versions greater than 1.3.34 and before 1.4.0 should verify and apply patches if necessary. This includes operators, platform administrators, vulnerability management teams, and security teams who manage or use the affected product. They should review session management configurations and consider compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook. This vulnerability trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature. An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens. This issue has a CVSS score of 2, indicating limited impact.

Defensive priority

Low CVSS score of 2 indicates limited impact; verify affected versions and apply patches.

Recommended defensive actions

• Verify better-auth version and apply patches if necessary
• Review and update session management configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The evidence for this CVE is limited. The vulnerability affects better-auth versions greater than 1.3.34 and before 1.4.0. The multi-session plugin's /sign-out after-hook trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature. Defenders should verify the affected versions are in use and apply patches if necessary. They should also review session management configurations and consider compensating controls for exposed systems.

Official resources