GHSA-wmjr-v86c-m9jj
NoneCVSS
—
EPSS
—
Published
Nov 26, 2025
CISA due date
—
The record
Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | better-auth | 1.3.34 | 1.4.0 |
Related vulnerabilities
- GHSA-cq3f-vc6p-68fh Better Auth: Device authorization approve and deny accept any authenticated session while… Also affects better-auth
- CVE-2026-45364 Better Auth is an authentication and authorization library for TypeScript. Also affects better-auth
- GHSA-p6v2-xcpg-h6xw Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix… Also affects better-auth
- GHSA-wxw3-q3m9-c3jr Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage… Also affects better-auth
- GHSA-xg6x-h9c9-2m83 Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching… Also affects better-auth
- GHSA-x732-6j76-qmhm Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass… Also affects better-auth
- GHSA-569q-mpph-wgww Better Auth affected by external request basePath modification DoS Also affects better-auth
- CVE-2025-61928 Better Auth is an authentication and authorization library for TypeScript. Also affects better-auth