better-auth EUVD-2025-210584

Exploitation requires all of the following: (1) the better-auth multi-session plugin must be explicitly enabled in the application - it is not active by default, and applications not using this plugin are entirely unaffected; (2) the attacker must hold a valid authenticated session with the application sufficient to reach the /sign-out endpoint (the CVSS 4.0 vector rates this PR:H, though the advisory description implies any authenticated session may suffice - verify with the vendor); (3) the target application must be running better-auth version 1.3.34 through <1.4.0; and (4) the attacker must supply session token IDs belonging to other users, which may require prior discovery through separate means. No code execution, privilege escalation, or data exfiltration is possible through this path - impact is limited to unauthorized session deletion. Applications running better-auth ≥1.4.0 or those that have never enabled the multi-session plugin are not affected.

The provided CVSS 4.0 score of 2.0 is low, driven by PR:H (high privileges required), AT:P (specific attack requirement: multi-session plugin must be enabled), and UI:P (passive user interaction - a victim session must exist to be revoked). Real-world risk is context-dependent: applications using better-auth's multi-session plugin face a meaningful, low-complexity session-disruption vector - an authenticated attacker can systematically revoke other users' sessions, creating a denial-of-service against account accessibility without exploiting any race condition or complex gadget chain. No EPSS data was supplied in this dataset, and the flaw is absent from the CISA KEV catalog, indicating no known active exploitation at time of analysis. The low base score reflects genuine access-gating (requires a valid session and explicit plugin use), but defenders in authentication-sensitive contexts (financial, admin, healthcare) should treat this as an elevated priority because session integrity is a foundational control. The CVSS 4.0 PR:H rating is inconsistent with the description, which implies only a regular authenticated session is needed; this discrepancy should be verified against the vendor fix before making risk classification decisions.

An attacker holding a valid better-auth account crafts an HTTP sign-out request to the application's /sign-out endpoint with a forged _multi-* cookie whose value contains the session token IDs of other currently authenticated users. Because the multi-session after-hook passes these values to internalAdapter.deleteSessions() without signature verification, the targeted sessions are immediately revoked, signing the victims out without their knowledge. If the attacker can enumerate or predict session token IDs through other means, they could perform a sweeping session-invalidation attack against the user base.