Executive brief
Better Auth, an authentication library for web applications, contains a flaw where user sessions remain active even after a user account has been deleted. This occurs when using external session storage like Redis or KV stores. In practice, an offboarded employee or deleted user could maintain access to the system for up to seven days, potentially allowing them to continue reading or modifying data despite their account being removed.
Technical details
A session management vulnerability exists in Better Auth when 'secondaryStorage' is enabled and 'storeSessionInDatabase' is disabled. The 'admin', 'anonymous', and 'SCIM' plugins call 'deleteUser' without explicitly invoking 'deleteSessions', leaving cached session payloads in external storage. An attacker with a pre-existing session cookie can continue to authenticate against 'getSessionFromCtx' until the session TTL (default 7 days) expires. The vulnerability is fixed in version 1.6.11 by ensuring 'deleteSessions' is called before 'deleteUser' across all deletion paths.
Affected products
- better-auth better-auth >= 0.3.4, < 1.6.11
- better-auth @better-auth/scim >= 1.6.0, < 1.6.11
Timeline
- 2026-05-31: disclosed
- 2026-07-07: advisory: GitHub Advisory published
- 2026-07-07: patched: Fixed in version 1.6.11