CVE-2026-67334

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 @better-auth/scim versions prior to 1.6.11

Description When secondaryStorage is configured and storeSessionInDatabase is set to false, certain user-deletion processes fail to remove cached sessions. This occurs because the internalAdapter.deleteUser(userId) function is called without first invoking internalAdapter.deleteSessions(userId), leaving the session payload in secondary storage. Consequently, session tokens for deleted users remain valid until the session Time To Live (TTL) expires, which is seven days by default, allowing unauthorized authentication and access to read and write surfaces.

The issue affects the following components:

Recommendations Upgrade better-auth to version 1.6.11 or later. Upgrade @better-auth/scim to version 1.6.11 or later. Set session.storeSessionInDatabase to true to ensure database cascades remove sessions. When using auth.api.removeUser, manually call auth.api.revokeUserSessions({ body: { userId } }). For SCIM deprovisioning, call auth.api.revokeUserSessions(...) after the SCIM DELETE operation. In the onLinkAccount hook for anonymous users, explicitly call internalAdapter.deleteSessions(anonymousUser.user.id) before issuing a new session.