Unknown · Better Auth · CVE-2026-67334
**Name of the Vulnerable Software and Affected Versions**
better-auth versions prior to 1.6.11
@better-auth/scim versions prior to 1.6.11
**Description**
When `secondaryStorage` is configured and `storeSessionInDatabase` is set to `false`, certain user-deletion processes fail to remove cached sessions. This occurs because the `internalAdapter.deleteUser(userId)` function is called without first invoking `internalAdapter.deleteSessions(userId)`, leaving the session payload in secondary storage. Consequently, session tokens for deleted users remain valid until the session Time To Live (TTL) expires, which is seven days by default, allowing unauthorized authentication and access to read and write surfaces.
The issue affects the following components:
- The `admin` plugin when calling `auth.api.removeUser(...)` or `authClient.admin.removeUser(...)`.
- The `anonymous` plugin via the `/delete-anonymous-user` endpoint or the after-link hook.
- The `@better-auth/scim` plugin via the `DELETE /scim/v2/Users/:userId` endpoint.
**Recommendations**
Upgrade better-auth to version 1.6.11 or later.
Upgrade @better-auth/scim to version 1.6.11 or later.
Set `session.storeSessionInDatabase` to `true` to ensure database cascades remove sessions.
When using `auth.api.removeUser`, manually call `auth.api.revokeUserSessions({ body: { userId } })`.
For SCIM deprovisioning, call `auth.api.revokeUserSessions(...)` after the SCIM DELETE operation.
In the `onLinkAccount` hook for anonymous users, explicitly call `internalAdapter.deleteSessions(anonymousUser.user.id)` before issuing a new session.