CVE-2026-67337 better-auth CVE debrief

Who should care

Developers and administrators using the better-auth library, especially those who have enabled session.cookieCache, should be aware of this vulnerability and take necessary actions to upgrade to version 1.4.9 or later. This includes reviewing and adjusting session.cookieCache settings, monitoring for suspicious authentication attempts, and implementing additional security measures for two-factor authentication. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize upgrading to version 1.4.9 or later to prevent potential two-factor authentication bypass. Operators and platform administrators should review the affected scope and take necessary actions to protect their environments. Vulnerability management teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Security teams should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory teams should review the affected scope and take necessary actions to protect their environments. Rollback/change windows teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Source tracking teams should track the vulnerability and verify the affected scope. Monitoring teams should monitor for suspicious authentication attempts and implement additional security measures for two-factor authentication. Compensating controls teams should review compensating controls for exposed systems while remediation is scheduled and verified. Exposure review teams should review the affected scope and take necessary actions to protect their environments. Vendor patch guidance teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is .

Technical summary

The better-auth library versions before 1.4.9 have a vulnerability that allows attackers with valid primary credentials to bypass two-factor authentication when session.cookieCache is enabled. This is due to premature session caching, which enables access to authenticated routes without completing the second-factor verification. The vulnerability impacts applications that use better-auth for two-factor authentication and have session.cookieCache enabled. To mitigate this vulnerability, it is recommended to upgrade to better-auth version 1.4.9 or later. Additionally, reviewing and adjusting session.cookieCache settings, monitoring for suspicious authentication attempts, and implementing additional security measures for two-factor authentication are advised.

Defensive priority

Organizations using better-auth versions before 1.4.9 should prioritize upgrading to 1.4.9 or later, especially if session.cookieCache is enabled, to prevent potential two-factor authentication bypass.

Recommended defensive actions

• Upgrade to better-auth version 1.4.9 or later
• Review and adjust session.cookieCache settings
• Monitor for suspicious authentication attempts
• Implement additional security measures for two-factor authentication
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE description indicates that better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching. The CVSS score is 7.1 with a HIGH severity.

Official resources