THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2025-71402 — better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g

[NVD] CVE-2025-71402 — better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g

mednvdPublished 2026-08-01

CVE-2025-71402 CVSS: None Published: 2026-08-01T13:16:55.510

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged

Indicators of compromise

CVE-2025-71402cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-71402