LOWVulnerability

CVE-2026-67334

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

Properties

severity
LOW
score
3.8
epss_score
0.00199
cve_id
CVE-2026-67334
vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
published_at
2026-08-01T13:17:04.263
last_modified
2026-09-08T20:34:34.997
epss_percentile
0.09756

Related Entities (3)

ENRICHED_BY (1)

[Source]FIRST EPSS

DESCRIBED_BY (1)

[Source]NVD

HAS_WEAKNESS (1)

[Weakness]Incomplete Cleanup

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-67334 — Ninja Signal Threat Intelligence | Ninja Signal