CVE-2026-67337: better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
better-authto a version that resolves this vulnerability.Fixed in 1.4.9 - Configuration
Disable session.cookieCache to prevent the two-factor authentication bypass (vulnerable when enabled in better-auth versions before 1.4.9).
better-auth session.cookieCache = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67337?
CVE-2026-67337 has a medium severity score of 6.5.
How do I fix CVE-2026-67337?
To fix CVE-2026-67337, upgrade to better-auth version 1.4.9 or later.
What software is affected by CVE-2026-67337?
CVE-2026-67337 affects better-auth versions before 1.4.9.
Can attackers exploit CVE-2026-67337 remotely?
Yes, attackers can exploit CVE-2026-67337 remotely if they have valid primary credentials.
What type of vulnerability is CVE-2026-67337?
CVE-2026-67337 is a two-factor authentication bypass vulnerability.