Vulnerabilities CVE-2026-67334

CVE-2026-67334

Medium

Open

TLP:CLEAR

better-auth Stale Sessions Persist After User Deletion

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

Details

CVSS Score: 5.1
EPSS Score ⓘ: 0.20%

10th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Aug 1, 2026
Last Modified: Aug 3, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.