CVE-2026-67334CWE-459

CVE-2026-67334

Low · published August 1, 2026

CVSS v3.1

3.8

EPSS

Percentile

24.1

In the wild

Unconfirmed

What it is

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

The record

Technical detail

CVSS v3.1: 3.8 · LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00323 · 24.1th percentile
Weakness: CWE-459 · Incomplete Cleanup
Published: 2026-08-01T17:17Z

References (2)

https://github.com/better-auth/better-auth/security/advisories/GHSA-2vg6-77g8-24mp · [email protected]https://www.vulncheck.com/advisories/better-auth-stale-sessions-persist-after-user-deletion · [email protected]

EPSS history

Timeline

01 AUG 12:22Z
better-auth Stale Sessions Persist After User Deletion
cvelistv5