Is there a patch available for CVE-2025-71402?

Yes, a patch is available for CVE-2025-71402. Update the affected software to the latest version immediately.

better-auth CVE-2025-71402

Q: What is the CVSS score of CVE-2025-71402?

CVE-2025-71402 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-210584 LOW

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-01 VulnCheck

GHSA-rf63-989x-x4x8

Information Disclosure Jwt Attack Better Auth

2.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.4 MEDIUM

Any authenticated session suffices (PR:L); no victim interaction needed; scope changes because other users' sessions are deleted, not the attacker's own.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 01, 2026 - 13:28 vuln.today

Analysis Generated

Aug 01, 2026 - 13:28 vuln.today

Patch available

Aug 01, 2026 - 13:01 EUVD

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

11 npm packages depend on better-auth (10 direct, 1 indirect)

Ecosystem-wide dependent count for version 1.3.34.

DescriptionCVE.org

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.

AnalysisAI

Session revocation via forged cookies in better-auth's multi-session plugin (npm, versions 1.3.34 through <1.4.0) allows any authenticated attacker to arbitrarily delete session tokens belonging to other users by supplying a crafted _multi-* cookie to the /sign-out after-hook, which forwards cookie values to internalAdapter.deleteSessions() without verifying the cryptographic signature. The flaw is not listed in the CISA KEV catalog and no public exploit code has been identified, but the low attack complexity makes unauthorized targeted session termination straightforward once an attacker holds any valid application session. Version 1.4.0 resolves the issue via patch commit cfc453a2a6eb02951f9a0a7c944064936e73eee8.

Technical ContextAI

better-auth is a TypeScript authentication library distributed via npm (CPE: cpe:2.3:a:better-auth:better-auth:*:*:*:*:*:*:*:*) that provides a multi-session plugin enabling users to maintain several concurrent authenticated sessions. The plugin registers an after-hook on the /sign-out route that reads raw _multi-* cookie values from the incoming request and passes the extracted session token identifiers directly to internalAdapter.deleteSessions(). The root cause is CWE-347 (Improper Verification of Cryptographic Signature): the application's security design relies on signed cookies to ensure the cookie value has not been tampered with by the client, but the after-hook reads the raw (unsigned) cookie instead of calling getSignedCookie or an equivalent verification function. Because cookie values are attacker-controlled HTTP headers, skipping signature verification means any value the attacker supplies - including session IDs belonging to other users - is treated as trusted input and acted upon by the session store.

RemediationAI

Upgrade better-auth to version 1.4.0 or later; this is the vendor-confirmed fix (patch commit cfc453a2a6eb02951f9a0a7c944064936e73eee8) and the only fully remediated path. Full details are in the GitHub Security Advisory at https://github.com/better-auth/better-auth/security/advisories/GHSA-wmjr-v86c-m9jj. If an immediate upgrade is not feasible, disabling the multi-session plugin is the most effective compensating control, as the vulnerability is entirely isolated to that plugin's /sign-out after-hook - the trade-off is that users will lose the ability to maintain concurrent sessions. As a lesser mitigation, rate-limiting the /sign-out endpoint per authenticated user can reduce the blast radius of bulk session-deletion attempts but will not prevent exploitation by a patient attacker and should not be treated as a substitute for patching.