CVE-2026-67334: better-auth Auth Bypass Vulnerability

CVE-2026-67334 Overview

CVE-2026-67334 affects better-auth versions before 1.6.11, an authentication library for TypeScript applications. The library fails to invalidate cached sessions when administrators remove users through admin, anonymous, or SCIM endpoints. This flaw appears only when secondaryStorage is configured and storeSessionInDatabase is set to false. Attackers holding a session token from a deleted account can continue to authenticate for up to seven days. The issue is tracked under CWE-459: Incomplete Cleanup.

Critical Impact
Deleted users retain full authenticated access to the application for up to seven days, defeating account revocation as a security control.

Affected Products

better-auth versions prior to 1.6.11
Deployments configured with secondaryStorage (for example, Redis-backed session cache)
Deployments where storeSessionInDatabase is set to false

Discovery Timeline

2026-08-01 - CVE-2026-67334 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67334

Vulnerability Analysis

The defect is an incomplete cleanup flaw in the user deletion code path. When an application uses secondaryStorage (a cache such as Redis) without persisting sessions to the primary database, better-auth writes active session records only to the cache. The admin, anonymous, and SCIM user-deletion handlers remove the user record but do not iterate the cache to purge outstanding session tokens tied to that user.

Because session tokens are validated against the cache and not cross-checked against user existence, the tokens continue to resolve to an authenticated principal. The default session lifetime governs the exposure window, which extends up to seven days. The vulnerability requires an attacker to already possess a valid session token for the account before deletion, which limits the attacker population but keeps the impact meaningful for insider threats, shared devices, and post-compromise scenarios.

Root Cause

The deletion routines in the affected endpoints operate on the user store only. They do not enumerate or invalidate entries in secondaryStorage keyed by user identifier. When storeSessionInDatabase is false, no database-side cascade exists to remove the orphaned session records, so the cache continues to serve stale sessions until natural token expiry.

Attack Vector

Exploitation requires a pre-existing valid session token for a user account that is subsequently deleted. The attacker replays the session cookie or bearer token against protected endpoints. better-auth looks up the token in secondaryStorage, finds the still-cached session, and returns an authenticated context. The deleted account's privileges remain effective for authorization decisions until the cached session record expires.

Refer to the GitHub Security Advisory GHSA-2vg6-77g8-24mp and the VulnCheck Advisory on Better Auth for full technical detail.

Detection Methods for CVE-2026-67334

Indicators of Compromise

Successful authenticated requests carrying a session token whose associated user identifier no longer exists in the user table.
Session cache entries in Redis or equivalent secondaryStorage referencing user IDs absent from the primary user store.
Audit log entries showing actions performed by user IDs that were removed via admin, anonymous, or SCIM deletion flows.

Detection Strategies

Add a reconciliation job that reads all session records from secondaryStorage and validates that each userId still resolves in the primary user store.
Instrument authentication middleware to log a security event when a session resolves to a userId that fails a live existence check.
Correlate SCIM DELETE /Users/{id} events with subsequent authenticated activity attributed to the same user identifier.

Monitoring Recommendations

Alert on any authenticated request occurring after a user deletion event for the same subject identifier.
Track the delta between session cache size and active user count over time; sustained growth indicates orphaned sessions.
Forward better-auth session validation logs into a centralized data lake to enable retroactive hunting once a user is deprovisioned.

How to Mitigate CVE-2026-67334

Immediate Actions Required

Upgrade better-auth to version 1.6.11 or later across all services.
Flush existing secondaryStorage session entries after upgrade to eliminate sessions that may have been orphaned before patching.
Audit recent admin, anonymous, and SCIM deletion events and force logout of any residual sessions tied to those user IDs.

Patch Information

The maintainers fixed the issue in better-auth1.6.11. The patched deletion handlers now enumerate and remove associated session records from secondaryStorage as part of the user deletion transaction. See the GitHub Security Advisory GHSA-2vg6-77g8-24mp for the fix commit and release notes.

Workarounds

Set storeSessionInDatabase to true so session state is authoritative in the database and cascades on user deletion.
Implement a post-deletion hook that manually deletes all cache keys associated with the removed user's session records.
Shorten session token lifetime in better-auth configuration to reduce the maximum exposure window below the default seven days.

bash

# Upgrade better-auth to the patched release
npm install better-auth@^1.6.11

# Optional hardening: force sessions to be stored in the primary database
# so that user deletion cascades invalidate session state
# better-auth configuration excerpt
# auth = betterAuth({
#   secondaryStorage: redisStore,
#   session: {
#     storeSessionInDatabase: true,
#     expiresIn: 60 * 60 * 24 // 1 day
#   }
# })