Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck

CVE-2025-71402better-auth before 1.4.0 Session Revocation via Forged Cookie

Low 2.0

In plain English

A low-severity security flaw in better-auth from better-auth. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.0Low

Exploit odds (30 days)0.3%top 81.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	better-auth	1.4.0	GHSA-wmjr-v86c-m9jj

Affected products (as reported)

Vendor	Product	Versions
better-auth	better-auth	0 – before 1.4.0

Weakness: CWE-347 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

References

GitHub Security Advisory (GHSA-wmjr-v86c-m9jj) vendor-advisory
VulnCheck Advisory: better-auth before 1.4.0 Session Revocation via Forged Cookie third-party-advisory