CVE-2026-67337 - better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache

Back Back to CVE browser

HIGH

better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache

Published Aug 1, 2026

7.1

HIGH

CVSS 4.0

EPSS 0.46%

Description

better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.

Affected products

Vendor Better-Auth Product Better-Auth Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.4.9
- Version
  1.4.9
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Better-Auth

unaffected

Version	Status	Constraints
0	affected	<1.4.9
1.4.9	unaffected	-

Ecosystem	Package	Introduced	Fixed
npm	better-auth	0	1.4.9

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-288

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51837
Advisory
https://github.com/better-auth/better-auth/security/advisories/GHSA-xg6x-h9c9-2m83
vendor-advisory
https://www.vulncheck.com/advisories/better-auth-before-two-factor-authentication-bypass-via-session-cookiecache
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51837		Advisory
https://github.com/better-auth/better-auth/security/advisories/GHSA-xg6x-h9c9-2m83		vendor-advisory
https://www.vulncheck.com/advisories/better-auth-before-two-factor-authentication-bypass-via-session-cookiecache		third-party-advisory