CVE-2025-71402 Overview
CVE-2025-71402 affects the better-auth authentication library, specifically the multi-session plugin's /sign-out after-hook. Vulnerable versions greater than 1.3.34 and before 1.4.0 trust raw multi-session cookies without verifying their signatures. The hook forwards extracted values directly to internalAdapter.deleteSessions without calling getSignedCookie or an equivalent verification routine. An attacker who supplies a forged _multi-* cookie can trigger deletion of arbitrary session tokens belonging to other users. The weakness is classified under [CWE-347: Improper Verification of Cryptographic Signature].
Critical Impact
Forged cookies allow attackers to revoke arbitrary user sessions, forcing denial of authenticated access across the application.
Affected Products
- better-auth versions greater than 1.3.34
- better-auth versions before 1.4.0
- Applications using the multi-session plugin
Discovery Timeline
- 2026-08-01 - CVE-2025-71402 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2025-71402
Vulnerability Analysis
The defect resides in the multi-session plugin shipped with better-auth. When a client issues a /sign-out request, the after-hook reads cookies prefixed with _multi- to determine which session tokens to invalidate. The hook parses these cookies as plain values and forwards the extracted session identifiers to internalAdapter.deleteSessions. Because the code path bypasses getSignedCookie, the server never confirms that the cookie was issued by the application. An attacker who knows or guesses a target session identifier can craft matching _multi-* cookies and submit them with a sign-out request to delete that session server-side.
The issue is a signature verification failure rather than a memory-safety bug. Exploitation produces authentication denial of service rather than direct data disclosure or code execution. Exploitation requires an authenticated context and some user interaction, which limits the practical blast radius.
Root Cause
The root cause is missing cryptographic verification of signed cookies in the multi-session sign-out flow. better-auth signs multi-session cookies at issuance, but the after-hook consumes the raw cookie value instead of the signed variant. Trusting attacker-controlled input as a session identifier violates the integrity guarantees the signing scheme was designed to provide.
Attack Vector
An attacker submits a crafted HTTP request to the /sign-out endpoint carrying one or more forged _multi-<id> cookies whose values reference session tokens the attacker wants to terminate. The after-hook extracts these values and calls internalAdapter.deleteSessions, revoking the referenced sessions. Repeated abuse can persistently log out targeted users or disrupt session continuity across an application. See the GitHub Security Advisory GHSA-wmjr-v86c-m9jj and the VulnCheck Advisory for additional detail.
Detection Methods for CVE-2025-71402
Indicators of Compromise
- Unexpected /sign-out requests containing multiple _multi-* cookies from a single client.
- Spikes in session deletions in internalAdapter.deleteSessions audit logs not correlated with legitimate logout activity.
- User reports of unexplained forced logouts affecting multiple accounts.
Detection Strategies
- Inspect application logs for /sign-out calls where the requesting user does not own the session tokens referenced by supplied _multi-* cookies.
- Compare cookie signatures at request time; log cookies that fail signature verification when replayed against getSignedCookie.
- Alert on session deletion rates that exceed baselines for individual accounts or source IPs.
Monitoring Recommendations
- Enable structured logging around all better-auth session lifecycle events, including creation, refresh, and deletion.
- Forward authentication telemetry to a centralized data lake for correlation with source IP, user agent, and account activity.
- Track anomalous cookie header composition on authentication endpoints and flag requests carrying many _multi-* cookies.
How to Mitigate CVE-2025-71402
Immediate Actions Required
- Upgrade better-auth to version 1.4.0 or later, which enforces signature verification on multi-session cookies.
- Audit recent internalAdapter.deleteSessions activity to identify sessions terminated via forged cookies.
- Rotate active sessions and require reauthentication for privileged accounts if forged-cookie activity is suspected.
Patch Information
The maintainers resolved the issue in better-auth version 1.4.0. The fix routes the /sign-out after-hook through getSignedCookie, so unsigned or invalid _multi-* cookies are rejected before reaching internalAdapter.deleteSessions. Refer to the GitHub Security Advisory GHSA-wmjr-v86c-m9jj for release details.
Workarounds
- If immediate upgrade is not possible, disable the multi-session plugin until the patched version can be deployed.
- Add a reverse-proxy or middleware rule that strips or validates _multi-* cookies on /sign-out requests.
- Restrict /sign-out to same-origin requests and enforce strict SameSite=Strict cookie attributes to reduce forged-request surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
