EUVD-2026-51837
GHSA-8pwm-pjg9-4h92
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the non-default dual-configuration prerequisite (2FA and cookieCache both active); PR:L for required primary credentials; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 10 npm packages depend on better-auth (8 direct, 3 indirect)
Ecosystem-wide dependent count for version 1.4.9.
DescriptionCVE.org
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.
AnalysisAI
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding valid primary credentials to access protected application routes without completing second-factor verification. The flaw stems from premature session caching: when session.cookieCache is enabled alongside 2FA, the session generated after primary sign-in is stored as fully valid before the second factor is checked, and subsequent lookups return the cached authenticated session without re-evaluating the 2FA requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is conceptually straightforward for any user or attacker who already possesses a valid username and password.
Technical ContextAI
better-auth is an open-source authentication framework for Node.js/TypeScript applications distributed via npm (CPE: cpe:2.3:a:better-auth:better-auth:*:*:*:*:*:*:*:*). The session.cookieCache feature is a performance optimization that stores resolved session data in a short-lived cookie-side cache to avoid repeated database lookups on every request. The root cause maps to CWE-288 (Authentication Bypass Using an Alternate Path or Channel): the caching layer represents an alternate path to session validation that bypasses the 2FA gate applied during the primary authentication flow. When the cache is consulted on a subsequent request, it returns the pre-2FA session object as fully authenticated, effectively short-circuiting the intended multi-step authentication logic.
RemediationAI
The primary fix is to upgrade better-auth to version 1.4.9, which corrects the session caching logic to ensure sessions are not treated as fully authenticated until all required authentication steps, including 2FA, are completed. This is confirmed by both the GitHub GHSA-xg6x-h9c9-2m83 advisory and the npm package vulnerability data. As a temporary workaround for deployments that cannot upgrade immediately, disable the session.cookieCache option when two-factor authentication is active - this eliminates the premature caching path at the cost of increased database load on session lookups. Disabling cookieCache does not affect correctness, only performance. No other workarounds are described in available advisories. Advisory: https://github.com/better-auth/better-auth/security/advisories/GHSA-xg6x-h9c9-2m83.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover whe
Better Auth is an authentication and authorization library for TypeScript. Rated medium severity (CVSS 6.9), this vulner
OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback st
Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser whe
Stale session persistence in better-auth allows deleted users to maintain authenticated access for up to seven days afte
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today