Executive brief
Better Auth is an authentication framework that manages user sessions and access control. When a user is deleted through admin, anonymous, or SCIM endpoints in configurations that cache sessions externally (Redis, KV), the deleted user's session remains valid for up to 7 days instead of being immediately revoked. This allows deleted users—including offboarded employees removed via SCIM—to continue accessing the application with their existing credentials during that window.
Technical details
The vulnerability is an incomplete cleanup issue (CWE-459) stemming from insufficient session expiration (CWE-613). When secondaryStorage is configured (Redis, KV, or external session cache) and storeSessionInDatabase is set to false (the default), four user-deletion code paths—admin plugin's removeUser, anonymous plugin's self-delete endpoint, anonymous plugin's after-link hook, and @better-auth/scim's DELETE /scim/v2/Users/:userId—call internalAdapter.deleteUser(userId) without first invoking internalAdapter.deleteSessions(userId). The deleted user's cached session payload remains in secondary storage, and subsequent calls to internalAdapter.findSession(token) return it as valid until the default 7-day session TTL expires. Exploitation requires that the attacker hold an existing session token for the deleted user; there is no network-level authentication bypass. The fix invokes deleteSessions(userId) before deleteUser(userId) at each vulnerable call site; patched versions are available at better-auth@1.6.11 and @better-auth/scim@1.6.11. Organizations can immediately mitigate by setting session.storeSessionInDatabase: true or by explicitly calling revokeUserSessions after delete operations.
Affected products
- better-auth better-auth 0.3.4 to 1.6.10
- better-auth @better-auth/scim 1.6.0 to 1.6.10
Timeline
- 2026-07-07: disclosed
- 2026-05-12: patched: Fixed in better-auth v1.6.11 and @better-auth/scim v1.6.11