CVE-2026-67334: better-auth Stale Sessions Persist After User Deletion
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
better-authto a version that resolves this vulnerability.Fixed in 1.6.11 - Configuration
Upgrade to better-auth 1.6.11; versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false.
better-auth secondaryStorage (and session deletion behavior when secondaryStorage is configured with storeSessionInDatabase=false) = Ensure cached sessions are deleted when removing users
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67334?
The severity of CVE-2026-67334 is rated low with a score of 3.8.
How does CVE-2026-67334 affect user security?
CVE-2026-67334 allows attackers to reuse stale session tokens of deleted users for up to seven days, potentially compromising account security.
Which versions of better-auth are affected by CVE-2026-67334?
CVE-2026-67334 affects better-auth versions prior to 1.6.11.
How do I fix CVE-2026-67334?
To remediate CVE-2026-67334, upgrade to better-auth version 1.6.11 or later.
What is the primary cause of CVE-2026-67334?
CVE-2026-67334 is caused by failure to delete cached sessions when users are removed, specifically when secondaryStorage is configured and storeSessionInDatabase is false.