Session Management Flaw in Better-Auth Affects User Deletion Process
CVE-2026-67334

5.1MEDIUM

Key Information:

Vendor

Better-auth

Status
Better-auth
Vendor
CVE Published:
1 August 2026

What is CVE-2026-67334?

The affected versions of Better-Auth fail to adequately handle user session deletions. When a user is removed through admin, anonymous, or SCIM endpoints, the system does not delete cached session tokens if secondaryStorage is configured and storeSessionInDatabase is false. This oversight allows attackers to exploit deleted user session tokens, maintaining unauthorized access for up to seven days after the account has been deleted, posing a significant security risk.

Affected Version(s)

better-auth 0.3.4 < 1.6.11

better-auth 1.6.0 < 1.6.11

better-auth 1.6.11

References

https://github.com/better-auth/better-auth/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/better-auth-stale-se...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

iruizsalinas
.