CVE-2026-67334

lowCVSS 3.8covered by 1 sourcefirst seen 2026-08-01

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

⚡ Watch CVE-2026-67334

Get an email if CVE-2026-67334 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

lowCVE-2026-67334: better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admi…nvd · 2026-08-01

External references

NVD record for CVE-2026-67334

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-67334 status](https://www.csirts.com/badge/CVE-2026-67334)](https://www.csirts.com/cve/CVE-2026-67334)