CVE-2026-67334 MEDIUM

CVE-2026-67334: better-auth Stale Sessions Persist After User Deletion

Vendor Better-Auth
Product better-auth
Weakness CWE-459
Published August 1, 2026
Last update August 1, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

Key dates

02Disclosure timeline

August 1, 2026 CVE published