CVE-2026-67334: Better Auth stale sessions after user deletion in secondary storage

CVE-2026-67334 · Severity: low · CVSS 3.8 · Published 2026-08-01

Better Auth is an authentication framework that manages user sessions and access control. When a user is deleted through admin, anonymous, or SCIM endpoints in configurations that cache sessions externally (Redis, KV), the deleted user's session remains valid for up to 7 days instead of being immediately revoked. This allows deleted users—including offboarded employees removed via SCIM—to continue accessing the application with their existing credentials during that window.

Technologies: better-auth (npm). Vendors: npm.

Quick answers

Is CVE-2026-67334 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-67334 being exploited in the wild.
How severe is CVE-2026-67334?
Low severity, with a CVSS score of 3.8, published 1 August 2026.
Which products and versions are affected?
@better-auth/scim (npm) SEMVER:introduced=1.6.0,fixed=1.6.11; better-auth (npm) SEMVER:introduced=0.3.4,fixed=1.6.11.
Is there a fix for CVE-2026-67334?
Yes. @better-auth/scim (npm): upgrade to 1.6.11 or later; better-auth (npm): upgrade to 1.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67334 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-67334?
Check whether you run @better-auth/scim (npm) or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @better-auth/scim (npm): upgrade to 1.6.11 or later
    npm install @better-auth/scim@1.6.11
  • better-auth (npm): upgrade to 1.6.11 or later
    npm install better-auth@1.6.11

Technical details

The vulnerability is an incomplete cleanup issue (CWE-459) stemming from insufficient session expiration (CWE-613). When secondaryStorage is configured (Redis, KV, or external session cache) and storeSessionInDatabase is set to false (the default), four user-deletion code paths—admin plugin's removeUser, anonymous plugin's self-delete endpoint, anonymous plugin's after-link hook, and @better-auth/scim's DELETE /scim/v2/Users/:userId—call internalAdapter.deleteUser(userId) without first invoking internalAdapter.deleteSessions(userId). The deleted user's cached session payload remains in secondary storage, and subsequent calls to internalAdapter.findSession(token) return it as valid until the default 7-day session TTL expires. Exploitation requires that the attacker hold an existing session token for the deleted user; there is no network-level authentication bypass. The fix invokes deleteSessions(userId) before deleteUser(userId) at each vulnerable call site; patched versions are available at better-auth@1.6.11 and @better-auth/scim@1.6.11. Organizations can immediately mitigate by setting session.storeSessionInDatabase: true or by explicitly calling revokeUserSessions after delete operations.

Affected products

  • better-auth better-auth 0.3.4 to 1.6.10
  • better-auth @better-auth/scim 1.6.0 to 1.6.10

Identifiers

  • CVE-2026-67334
  • GHSA-2vg6-77g8-24mp

Timeline

  • 2026-07-07: disclosed
  • 2026-05-12: patched: Fixed in better-auth v1.6.11 and @better-auth/scim v1.6.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.