6.5Orta
CVE-2026-67337better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
Açıklama
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.
Zayıflık türü (CWE):
CWE-288
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| better-auth | better-auth | < 1.4.9, fixed 1.4.9 | |
| better-auth | better-auth/oauth-provider | < 1.4.9 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-xg6x-h9c9-2m83) vendor-advisory
- VulnCheck Advisory: better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache third-party-advisory