CVE-2026-67337: better-auth 2FA Bypass Vulnerability

CVE-2026-67337 Overview

CVE-2026-67337 is a two-factor authentication (2FA) bypass vulnerability in the better-auth authentication library. It affects all versions prior to 1.4.9 when the session.cookieCache feature is enabled. Attackers who possess valid primary credentials can access authenticated routes without completing the required second-factor verification step. The root cause is premature session caching, which stores the session before the second-factor challenge is satisfied. The flaw is categorized under [CWE-288: Authentication Bypass Using an Alternate Path or Channel]. Applications relying on better-auth to enforce 2FA on sensitive routes are exposed when this caching option is active.

Critical Impact
Attackers holding valid username and password pairs can reach 2FA-protected routes without providing the second factor, defeating multi-factor authentication controls.

Affected Products

better-auth versions before 1.4.9
Deployments with session.cookieCache enabled
Applications enforcing two-factor authentication through better-auth

Discovery Timeline

2026-08-01 - CVE-2026-67337 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67337

Vulnerability Analysis

The vulnerability lives in the session lifecycle handling of better-auth. When session.cookieCache is enabled, the library caches session data in a signed cookie to reduce database lookups. The cache is populated after primary credential verification but before the two-factor challenge completes. Subsequent requests read the cached session and treat the user as fully authenticated. Middleware guarding protected routes therefore accepts the request without demanding the second factor.

The attack requires a network-reachable endpoint and a valid primary credential set. No user interaction, elevated privilege, or complex conditions are needed once credentials are known. Exploitation grants full access to any resource that depends on better-auth for 2FA enforcement.

Root Cause

The session state machine writes a "session established" record to the cookie cache immediately after password verification. The twoFactorPending state is not persisted to the cookie cache, and cache reads do not consult the pending-2FA flag. As a result, the second-factor step is treated as optional by downstream authorization checks.

Attack Vector

An attacker with harvested credentials, from phishing, credential stuffing, or a prior breach, submits a normal login request. After receiving the session cookie, the attacker requests any protected route directly. Because the cached session indicates an authenticated user, the request succeeds. Verified technical details are documented in the GitHub Security Advisory GHSA-xg6x-h9c9-2m83 and the VulnCheck Security Advisory.

Detection Methods for CVE-2026-67337

Indicators of Compromise

Successful access to 2FA-protected endpoints without a preceding call to the two-factor verification endpoint in the same session.
Session cookies issued from better-auth reused across privileged routes with no corresponding second-factor event.
Authentication logs showing password-only logins immediately followed by sensitive resource access.

Detection Strategies

Inventory application dependencies and flag any deployment using better-auth at a version below 1.4.9.
Correlate authentication events: every login for a 2FA-enrolled user should include a matching second-factor verification event before session use.
Alert on protected route access when the associated session lacks a twoFactorVerified claim or equivalent server-side marker.

Monitoring Recommendations

Ingest better-auth authentication logs into a centralized data lake for correlation across login, 2FA, and route access events.
Monitor for anomalous authentication sequences from IP addresses or user agents inconsistent with historical user behavior.
Track configuration changes that toggle session.cookieCache on production services.

How to Mitigate CVE-2026-67337

Immediate Actions Required

Upgrade better-auth to version 1.4.9 or later across all environments.
Audit application configuration for session.cookieCache usage and confirm the upgrade is deployed before re-enabling it.
Invalidate all active sessions after upgrading to force re-authentication and force a fresh 2FA challenge.
Review authentication logs for the last 90 days for signs of exploitation against 2FA-enrolled accounts.

Patch Information

The fix is available in better-auth version 1.4.9. Details of the corrected session caching logic are described in the GitHub Security Advisory GHSA-xg6x-h9c9-2m83.

Workarounds

Disable session.cookieCache until the upgrade to 1.4.9 is complete.
Add server-side enforcement that rejects requests to protected routes when the session lacks a verified second-factor marker.
Reduce session lifetime and require step-up authentication on sensitive operations to limit the exploitation window.

bash

# Upgrade better-auth to the patched version
npm install better-auth@^1.4.9

# Or, as a temporary workaround, disable cookie cache in your auth config
# session: {
#   cookieCache: {
#     enabled: false
#   }
# }