Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-71402— better-auth before 1.4.0 Session Revocation via Forged Cookie

CVSS 2.0 · Low EPSS 0.21% · P11

Possible ATT&CK Techniques 1AI

T1136.003 · Cloud Account

Affected Version Matrix 2

VendorProductVersion RangeStatus
better-authbetter-auth< 1.4.0affected
1.4.0unaffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2025-71402

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
better-auth before 1.4.0 Session Revocation via Forged Cookie
Source: CVE Program / CVE List V5
Vulnerability Description
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
better-auth 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
better-auth是better-auth团队开源的一个身份验证框架。 better-auth 1.3.34之后版本和1.4.0之前版本存在加密问题漏洞，该漏洞源于multi-session插件的/sign-out after-hook信任原始multi-session cookie，未验证cookie签名即将提取值转发给internalAdapter.deleteSessions，攻击者可提供伪造的_multi-* cookie触发删除任意会话令牌。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
better-authbetter-auth 0 ~ 1.4.0 -

II. Public POCs for CVE-2025-71402

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-71402

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-71402 (2)

Same Patch Batch · better-auth · 2026-08-01 · 14 CVEs total

CVE-2026-673309.9 CRITICALbetter-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision
CVE-2026-673368.7 HIGHbetter-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider
CVE-2026-673278.3 HIGHbetter-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
CVE-2026-673318.3 HIGHbetter-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass
CVE-2026-673288.1 HIGH@better-auth/sso before 1.6.21 Account Takeover via SSO
CVE-2026-673337.2 HIGHbetter-auth before 1.6.13 Stored XSS via javascript redirect_uri
CVE-2026-673297.1 HIGH@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription
CVE-2025-714037.1 HIGHbetter-auth before 1.1.20 Open Redirect via trustedOrigins Bypass
CVE-2026-673376.5 MEDIUMbetter-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
CVE-2026-673326.4 MEDIUM@better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass
CVE-2026-673355.3 MEDIUMbetter-auth before 1.6.2 OAuth State Validation Bypass
CVE-2025-714045.1 MEDIUMbetter-auth before 1.1.16 Reflected XSS via error parameter
CVE-2026-673343.8 LOWbetter-auth Stale Sessions Persist After User Deletion

IV. Related Vulnerabilities

Same product: better-auth
Same vendor: better-auth
Same weakness: CWE-347

V. Comments for CVE-2025-71402

No comments yet

Leave a comment