CVE-2025-71402

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

EUVD-2025-210584

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

CVE-2025-71402 better-auth before 1.4.0 Session Revocation via Forged Cookie

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

CVE-2025-71402

The CVE affects better-auth versions >1.3.34 and

CVE-2025-71402 better-auth before 1.4.0 Session Revocation via Forged Cookie

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

CVE-2025-71402

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

PYSEC-2026-360 Session Fixation in ipsilon

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active...

Exploit for CVE-2026-24061

CVE-2026-24061 Vulnerability Detection and Exploitation Tool...

GHSA-WMJR-V86C-M9JJ Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

Summary A vulnerability was identified in the multi-session plugin for Better Auth, specifically in the /sign-out after-hook. The hook trusts raw multi-session cookies and forwards the extracted values directly to internalAdapter.deleteSessions without verifying the cookie signature. Because cook...

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions

Summary A vulnerability was identified in the multi-session plugin for Better Auth, specifically in the /sign-out after-hook. The hook trusts raw multi-session cookies and forwards the extracted values directly to internalAdapter.deleteSessions without verifying the cookie signature. Because cook...

EUVD-2025-199765

Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions...

EUVD-2022-2125

Malicious code in bioql PyPI...

EUVD-2024-48283

Malicious code in bioql PyPI...

LogonUI.exe process hanging after logoff from multi-session VDA

When utilizing multi-session VDA with the Duo Security agent installed, users may close out the applications in an attempt to log off of the VDA but the LogonUI.exe process will hang. This will result in multiple Terminal Services sessions showing active with the same session number, but no user...

Enabling WPF Rendering for Citrix HDX on Multi-Session VDAs

Overview Windows Presentation Foundation WPF applications can leverage GPU acceleration in Citrix Virtual Apps and Desktops CVAD environments running Windows Multi-session OS. By enabling WPF rendering on the server’s GPU, this reduces CPU load and improves graphics performance for WPF...

Teams 2.x missing from start menu on Server 2022/W11 Multi-session when installed in an App Layer

When deploying Teams 2.x in an App Layer on Server 2022/W11 Multi-session, Teams would not show up in the start menu...

CVE-2024-7345

Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents on supported OpenEdge LTS platforms up to OpenEdge LTS 11.7.18 and LTS 12.2.13 on all supported release platforms...

PT-2024-38278 · Progress · Openedge

Name of the Vulnerable Software and Affected Versions: OpenEdge LTS versions prior to 11.7.18 OpenEdge LTS versions prior to 12.2.13 Description: A Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents o...

Progress Software OpenEdge 安全漏洞

Progress Software OpenEdge is a suite of integrated development environments IDEs from Progress Software, USA. A security vulnerability exists in Progress Software OpenEdge versions 11.7.18 and 12.2.13. An attacker can exploit the vulnerability to inject unauthorized code into a multi-session age...

Unable to Launch Applications After VDA Upgrade to 1912 CU9 Due to Missing Working Directory

Please note: You can download the required file from the Citrix downloads website by visiting the following link:https://www.citrix.com/downloads/citrix-tools To apply the updated DLL with the tested code changes, please replace the files in the specified locations on the Multi-Session VDA as...