CVE-2026-67334
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.
Risk Assessment
This allows unauthorized access to the system by former users whose accounts have been deleted, compromising data integrity and confidentiality.
Recommendation
Update better-auth to version 1.6.11 or later, which includes the fix for cached session deletion.
Original NVD description (English source)
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.