Low severity3.8NVD Advisory· Published Aug 1, 2026· Updated Sep 8, 2026

CVE-2026-67334

Description

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Better Auth/Better Authllm-create
Range: <1.6.11

Patches

Vulnerability mechanics

References

github.com/better-auth/better-auth/security/advisories/GHSA-2vg6-77g8-24mpnvd
www.vulncheck.com/advisories/better-auth-stale-sessions-persist-after-user-deletionnvd

News mentions

Better Auth: 17 Vulnerabilities Disclosed Together, Including Critical Authorization Bypass Flaws
Vypr Intelligence · Aug 2, 2026

cvss	0.247
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000