CVE-2026-67334

Published: Ago 01, 2026 Last Modified: Ago 01, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 5,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW 3,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: high
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none

Description

AI Translation Available

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

459

Incomplete Cleanup

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Other Confidentiality Integrity
Potential Impacts:
Other Read Application Data Modify Application Data Dos: Resource Consumption (Other)
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/better-auth/better-auth/security/advisor…
https://github.com/better-auth/better-auth/security/advisories/GHSA-2vg6-77g8-2…
https://www.vulncheck.com/advisories/better-auth-stale-sess…
https://www.vulncheck.com/advisories/better-auth-stale-sessions-persist-after-u…