{"id":"EUVD-2025-210584","enisaUuid":"91d0ed11-56dd-35b7-9e89-859bd6a81f7b","description":"better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin\u0027s /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.","datePublished":"Aug 1, 2026, 12:22:16 PM","dateUpdated":"Aug 3, 2026, 7:32:01 PM","baseScore":2.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N","references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-wmjr-v86c-m9jj\nhttps://www.vulncheck.com/advisories/better-auth-before-session-revocation-via-forged-cookie\n","aliases":"CVE-2025-71402\nGHSA-rf63-989x-x4x8\n","assigner":"VulnCheck","epss":0.27,"enisaIdProduct":[{"id":"83a1a6c1-7999-32b0-a330-6e4a574defb1","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"0 \u003c1.4.0"}],"enisaIdVendor":[{"id":"afaa9a2e-5687-326c-8ba8-274f2e751ffa","vendor":{"name":"better-auth"}}],"enisaIdVulnerability":[{"id":"6cd24fec-f6e2-34d9-b244-1a9b0289e8d8","vulnerability":{"id":"CVE-2025-71402","description":"better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin\u0027s /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.","datePublished":"Aug 1, 2026, 12:22:16 PM","dateUpdated":"Aug 3, 2026, 7:32:01 PM","status":"PUBLISHED","baseScore":2.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N","references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-wmjr-v86c-m9jj\nhttps://www.vulncheck.com/advisories/better-auth-before-session-revocation-via-forged-cookie\n","enisa_id":"EUVD-2025-210584\n","assigner":"VulnCheck","epss":0.27,"dataProcessed":"Nov 4, 2026, 7:19:11 AM","vulnerabilityProduct":[{"id":"9860544e-af10-3907-9deb-9208318e541e","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"0 \u003c1.4.0"}],"vulnerabilityVendor":[{"id":"22f60dd6-a1bd-3dc3-ba5b-691944c28c49","vendor":{"name":"better-auth"}}]}},{"id":"a0c8c2cf-6567-3a3d-b4e2-af4c5bc9cd0d","vulnerability":{"id":"GHSA-rf63-989x-x4x8","description":"better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin\u0027s /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.","datePublished":"Aug 1, 2026, 3:30:23 PM","dateUpdated":"Aug 1, 2026, 3:30:23 PM","baseScore":0.0,"references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-wmjr-v86c-m9jj\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71402\nhttps://www.vulncheck.com/advisories/better-auth-before-session-revocation-via-forged-cookie\n","enisa_id":"EUVD-2025-210584\n","aliases":"CVE-2025-71402\nGHSA-rf63-989x-x4x8\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}