CyberRota Analysis
AI-GeneratedThe vulnerability exists in the multi-session plugin of better-auth versions greater than 1.3.34 and before 1.4.0, where the /sign-out after-hook improperly trusts raw multi-session cookies. This flaw allows an attacker to forge a _multi-* cookie, potentially leading to the deletion of arbitrary session tokens and unauthorized access to user sessions. Organizations using affected versions should prioritize remediation to mitigate the risk of session hijacking and unauthorized account access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature (e.g., via getSignedCookie). An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.