THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-67334 (LOW 3.8) — better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up

[NVD] CVE-2026-67334 (LOW 3.8) — better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up

mednvdPublished 2026-08-01

CVE-2026-67334 CVSS: 3.8 LOW Published: 2026-08-01T13:17:04.263

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

Indicators of compromise

CVE-2026-67334cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-67334