CVE-2025-71402 better-auth before 1.4.0 Session Revocation via Forged Cookie
Attackers can forge multi-session cookies to delete arbitrary user sessions, causing denial of service and bypassing authentication controls in better-auth.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-71402?
CVE-2025-71402 is a low-severity authentication bypass vulnerability in better-auth, published on 1 Aug 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.
Weakness: CWE-347
Which versions are affected by CVE-2025-71402?
2 open source packages ship an affected version, including better-auth.
| Package | Affected | Fixed in |
|---|---|---|
better-auth npm | From 1.3.34 | 1.4.0 |
better-auth npm | From 1.3.34 | 1.4.0 |
How do I fix CVE-2025-71402?
Upgrade better-auth to 1.4.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-71402 being exploited?
There is no known exploitation of CVE-2025-71402 in the wild and no public exploit code.
Sources
Also known as GHSA-rf63-989x-x4x8, GHSA-wmjr-v86c-m9jj.