EUVD-2026-51828
GHSA-gj53-4jmf-7745
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploiting the stale session needs no current privileges (account is deleted), but requires a specific non-default deployment configuration - secondaryStorage plus storeSessionInDatabase=false - warranting AC:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.
AnalysisAI
Stale session persistence in better-auth allows deleted users to maintain authenticated access for up to seven days after account removal. Affected are deployments of better-auth versions 0.3.4 through 1.6.10 running with secondaryStorage (Redis, KV, or similar external cache) and the default storeSessionInDatabase=false setting, where user deletion flows through the admin, anonymous, or SCIM plugins. Because deleteSessions is never called before deleteUser in these code paths, the session payload remains live in the cache until TTL expiry, meaning a terminated employee or compromised account that has been administratively deleted can continue making authenticated requests. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
better-auth is a Node.js/TypeScript authentication library distributed via npm (cpe:2.3:a:better-auth:better-auth:*:*:*:*:*:*:*:*). When secondaryStorage is configured, session tokens are stored in an external cache (Redis, Cloudflare KV, etc.) rather than solely in the primary database. CWE-459 (Incomplete Cleanup) is the root cause: four specific deletion call sites - admin plugin removeUser (packages/better-auth/src/plugins/admin/routes.ts:1463), anonymous plugin self-delete (packages/better-auth/src/plugins/anonymous/index.ts:222), anonymous plugin after-link hook (index.ts:325), and SCIM DELETE /scim/v2/Users/:userId (packages/scim/src/routes.ts:1019) - invoke internalAdapter.deleteUser(userId) without first calling internalAdapter.deleteSessions(userId). The session record in secondary storage is never evicted, so findSession(token) continues to resolve the deleted user's cached session object as valid until the 7-day default TTL elapses. By contrast, the core /delete-user self-delete and /delete-user/callback routes already call deleteSessions correctly and are not vulnerable.
RemediationAI
Upgrade to better-auth@1.6.11 (and @better-auth/scim@1.6.11 if the SCIM plugin is in use), as confirmed by npm package metadata and the GHSA advisory at https://github.com/better-auth/better-auth/security/advisories/GHSA-2vg6-77g8-24mp. The fix extends all four vulnerable call sites to invoke deleteSessions(userId) before deleteUser(userId) and includes an architectural follow-up to centralize cleanup inside deleteUser. If immediate upgrade is not feasible, setting session.storeSessionInDatabase to true eliminates the vulnerability entirely because database-level cascades then handle session removal - trade-off is increased database read load for session lookups. A second workaround is to manually flush the deleted user's session keys from secondary storage (Redis DEL or KV delete) at the application layer immediately after calling removeUser; this requires custom wrapper code and carries a risk of implementation gaps. Reducing session TTL below the default seven days limits the exploitation window but does not eliminate it. No compensating control short of the upgrade or storeSessionInDatabase=true fully closes the gap.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover whe
Better Auth is an authentication and authorization library for TypeScript. Rated medium severity (CVSS 6.9), this vulner
OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback st
Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser whe
Same weakness CWE-459 – Incomplete Cleanup
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today