CVE-2026-67334
CVE-2026-67334 · better-auth Stale Sessions Persist After User Deletion
This page contains facts from public vulnerability sources. Check the original advisory before updating.
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.
CVSS 5.1 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
better-auth
- Versions
- ≥ 0.3.4, < 1.6.11: Affected (semver)
- 1.6.11: Not affected (semver)
Update to 1.6.11
better-auth
- Versions
- ≥ 1.6.0, < 1.6.11: Affected (semver)
- 1.6.11: Not affected (semver)
Update to 1.6.11
better-auth npm
- Affected ranges
- SEMVER: ≥ 0.3.4, < 1.6.11
Update to 1.6.11
@better-auth/scim npm
- Affected ranges
- SEMVER: ≥ 1.6.0, < 1.6.11
Update to 1.6.11