6.5Medium
CVE-2026-67337better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
Description
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.
Weakness (CWE):
CWE-288
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| better-auth | better-auth | < 1.4.9, fixed 1.4.9 | |
| better-auth | better-auth/oauth-provider | < 1.4.9 |
References and patches
- GitHub Security Advisory (GHSA-xg6x-h9c9-2m83) vendor-advisory
- VulnCheck Advisory: better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache third-party-advisory