6.5Mittel
CVE-2026-67337better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
Beschreibung
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.
Schwachstellentyp (CWE):
CWE-288
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| better-auth | better-auth | < 1.4.9, fixed 1.4.9 | |
| better-auth | better-auth/oauth-provider | < 1.4.9 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-xg6x-h9c9-2m83) vendor-advisory
- VulnCheck Advisory: better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache third-party-advisory