Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-67334

better-auth Stale Sessions Persist After User Deletion

At a glance

Severity
MEDIUM 5.1
EPSS
EPSS 0.32 % · percentile 25 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
VulnCheck
NVD status
Deferred

Description

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

Scores

VersionScoreVectorScored by
CVSS 4.0MEDIUM 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NVulnCheck
CVSS 3.1LOW 3.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NVulnCheck
CVSS 4.0MEDIUM 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1LOW 3.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NNVD · disclosure@vulncheck.com (Secondary)

Weaknesses (CWE)

Advisories

European references

Affected products

ProductVersions
better-auth · better-authaffected 0.3.4 < 1.6.11 ; unaffected 1.6.11
better-auth · better-authaffected 1.6.0 < 1.6.11 ; unaffected 1.6.11

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD