What is GHSA-gj53-4jmf-7745?

GHSA-gj53-4jmf-7745 is a security advisory published by GitHub Security Advisories with Medium severity. better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin,...

Which CVE IDs does GHSA-gj53-4jmf-7745 cover?

GHSA-gj53-4jmf-7745 covers the following CVE IDs: CVE-2026-67334. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gj53-4jmf-7745?

GHSA-gj53-4jmf-7745 has a CVSS v3 base score of 3.8, published by GitHub Security Advisories.

GHSA-gj53-4jmf-7745MediumCVSS 3.8

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin,...

Vendor

GitHub Security Advisories

Published

August 1, 2026

Last Modified

August 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-67334 →

📋 Description

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

🔗 References (4)

https://github.com/better-auth/better-auth/security/advisories/GHSA-2vg6-77g8-24mp
https://nvd.nist.gov/vuln/detail/CVE-2026-67334
https://www.vulncheck.com/advisories/better-auth-stale-sessions-persist-after-user-deletion
https://github.com/advisories/GHSA-gj53-4jmf-7745