The vulnerability exists in the sign‑out after‑hook of the multi‑session plugin powered by better‑auth. It accepts raw multi‑session cookies, extracts token values, and forwards them directly to internalAdapter.deleteSessions without validating that the cookie was signed. An attacker can manipulate the _multi‑* cookie to cause the system to delete any session token belonging to any user, effectively forcing a logout or disabling service access for a victim. Although the flaw does not provide code execution, it undermines the integrity of the session state and can be leveraged to deny service or disrupt user sessions.

This weakness affects the better‑auth authentication library, specifically all releases greater than 1.3.34 and up to, but not including, 1.4.0.

The CVSS score of this vulnerability is 2, indicating low severity, and no EPSS data is available. It is not listed in the CISA KEV catalog. The most likely attack vector relies on an attacker being able to supply a forged _multi‑* cookie in an HTTP request to a target system that employs the vulnerable plugin. Since cookie manipulation can be carried out from a remote client, the exploit is remotely exploitable but requires the attacker to have some interaction with the target environment, such as controlling a browser session or tricking an authenticated user into sending a crafted request. Due to the low CVSS rating and absence of documented exploitation, the risk is considered low, but the impact on session integrity remains significant for organizations relying on uninterrupted authentication flow.