CVE-2026-67337 — better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can acce…
Published: 2026-08-01 · CVSS: 7.1 · CVSS 4.0
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7