Low severity · published Aug 1, 2026
CVE-2026-67334
better-auth Stale Sessions Persist After User Deletion
3.8
CVSS
0.3%
EPSS
No
On KEV
Description
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
better-auth · better-auth
0.3.4 before 1.6.11; 1.6.0 before 1.6.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67334
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67334
vendor-advisory
https://github.com/better-auth/better-auth/security/advisories/GHSA-2vg6-77g8-24mp
third-party-advisory
https://www.vulncheck.com/advisories/better-auth-stale-sessions-persist-after-user-deletion
More from better-auth
9.6
CVE-2026-53513
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
9.3
CVE-2025-61928
Better Auth: Unauthenticated API key creation through api-key plugin
9.1
CVE-2026-114607
better-auth: OAuth state can be used as a Magic Link to sign in as another user
9.1
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
9.1
CVE-2026-53512
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins