CVE-2025-71402 in better-auth
Summary
by MITRE • 08/01/2026
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability exists within the better-auth multi-session plugin functionality where version 1.3.35 through 1.3.39 are affected by a critical security flaw in the sign-out after-hook mechanism. This issue stems from improper validation of session cookies during the logout process, creating a path for unauthorized session termination. The vulnerability specifically targets the internalAdapter.deleteSessions method which receives session identifiers extracted from multi-session cookies without proper signature verification.
The technical implementation flaw occurs when the system processes the /sign-out endpoint where the application trusts raw cookie values directly without first validating their authenticity through cryptographic signature checks. This design decision exposes the system to cookie manipulation attacks where malicious actors can craft forged _multi-* cookies containing arbitrary session identifiers. The absence of getSignedCookie verification creates a direct path for attackers to manipulate session data, as the system assumes all incoming cookie values are legitimate and authentic.
From an operational impact perspective, this vulnerability allows attackers to perform unauthorized session termination across multiple user accounts simultaneously. An attacker who can observe or predict valid session identifiers can forge cookies that target specific sessions for deletion, effectively enabling account takeover capabilities and session hijacking attacks. The vulnerability operates at the application layer and does not require elevated privileges or specialized tools beyond basic web application exploitation techniques.
The flaw aligns with CWE-347 weakness category focusing on improper validation of certificates and cryptographic signatures, specifically manifesting as a failure to verify cookie authenticity during session management operations. This vulnerability also maps to ATT&CK technique T1531 which involves manipulation of authentication tokens and session management components to gain unauthorized access or disrupt legitimate user sessions.
Recommended mitigations include implementing proper cookie signature verification using the getSignedCookie function before processing session identifiers, adding cryptographic validation to all multi-session cookies received by the system. Organizations should upgrade to better-auth version 1.4.0 or later where this vulnerability has been addressed through proper signature validation mechanisms. Additionally, implementing rate limiting on sign-out operations and monitoring for unusual session deletion patterns can help detect potential exploitation attempts. The fix requires modification of the multi-session plugin's after-hook implementation to validate cookie integrity before proceeding with session termination operations.