Packages / better-auth / Security

LowVulnerabilityGHSA-wmjr-v86c-m9jjCVE-2025-71402Published 26 Nov 2025

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

Affected releases · better-auth

  • 1.x1.3.34Fixed in 1.4.0

On 1.x, the newest line:

npm install better-auth@1.4.0

  1. Not affected

    0.0.1 – 1.3.33

    152 releases

  2. Affected

    1.3.34

    1 release

  3. Fixed

    1.4.0 – 1.7.12

    77 releases, latest

230 stable releases of better-auth, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for better-auth. It is read in your browser and sent nowhere.

What happens

Summary

A vulnerability was identified in the multi-session plugin for Better Auth, specifically in the /sign-out after-hook. The hook trusts raw multi-session cookies and forwards the extracted values directly to internalAdapter.deleteSessions without verifying the cookie signature. Because cookie values are not validated with getSignedCookie (or any equivalent check), an attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.