CVE-2025-71402 better-auth CVE debrief

Who should care

Defenders responsible for maintaining and securing applications that use the better-auth library, particularly those using versions greater than 1.3.34 and before 1.4.0, should be aware of this vulnerability. They should assess their exposure and take necessary actions to prevent potential session token deletion.

Why it matters

Defenders should care about CVE-2025-71402 because it allows an attacker to delete arbitrary session tokens in better-auth versions greater than 1.3.34 and before 1.4.0. This could disrupt user sessions and requires verification of affected versions and application of patches.

• Potential deletion of arbitrary session tokens
• Possible disruption to user sessions
• Need for verification of affected versions and application of patches

Technical summary

The better-auth library, used for authentication, has a vulnerability in its multi-session plugin. Specifically, the /sign-out after-hook does not properly verify the signature of multi-session cookies. This allows an attacker to forge a _multi-* cookie, which can then be used to trigger the deletion of arbitrary session tokens. The affected versions are greater than 1.3.34 and before 1.4.0. This vulnerability can lead to potential deletion of arbitrary session tokens and disruption of user sessions. Defenders should verify the affected version of better-auth and apply necessary patches to prevent potential session token deletion.

Defensive priority

Defenders should prioritize verifying the affected version of better-auth and applying the necessary patches to prevent potential session token deletion.

Recommended defensive actions

• Verify the version of better-auth in use and apply patches if necessary
• Review and update session management configurations to prevent potential session token deletion
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in better-auth versions greater than 1.3.34 and before 1.4.0. The vulnerability allows an attacker to supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.