CVE-2025-71402
1 advisory.
npm/better-auth CVE-2025-71402: low
Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions
Action: Upgrade better-auth to 1.4.0 or later.
npm i better-auth@1.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.34 | 1.4.0 | - |
Fixed versions
| 1.4.0 |
Sources
- osv: GHSA-wmjr-v86c-m9jj
- https://github.com/better-auth/better-auth/security/advisories/GHSA-wmjr-v86c-m9jj
- https://github.com/better-auth/better-auth/commit/cfc453a2a6eb02951f9a0a7c944064936e73eee8
- https://github.com/better-auth/better-auth
- https://github.com/better-auth/better-auth/releases/tag/v1.4.0
CVE-2025-71402 · published · modified · JSON