Better Auth's multi-session plugin versions 1.3.34 up to but not including 1.4.0 contains a vulnerability in its sign-out after-hook. The hook improperly trusts raw multi-session cookies without verifying their signatures, allowing an attacker to supply forged cookies that can delete arbitrary session tokens. This flaw is fixed in version 1.4.0.