Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2026-67334

better-auth Stale Sessions Persist After User Deletion

En bref

Sévérité
MEDIUM 5.1
EPSS
EPSS 0.32 % · centile 25 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
VulnCheck
Statut NVD
Deferred

Description

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

Scores

VersionScoreVecteurÉvalué par
CVSS 4.0MEDIUM 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:NVulnCheck
CVSS 3.1LOW 3.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NVulnCheck
CVSS 4.0MEDIUM 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1LOW 3.8CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NNVD · disclosure@vulncheck.com (Secondary)

Faiblesses (CWE)

Avis

Références européennes

Produits affectés

ProduitVersions
better-auth · better-authaffected 0.3.4 < 1.6.11 ; unaffected 1.6.11
better-auth · better-authaffected 1.6.0 < 1.6.11 ; unaffected 1.6.11

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD