CVE-2026-67337 in better-auth
Summary
by MITRE • 08/01/2026
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in better-auth versions prior to 1.4.9 represents a critical security flaw that undermines the integrity of multi-factor authentication mechanisms through improper session handling. This issue manifests when the session.cookieCache configuration is enabled, creating a window where attackers can bypass the second factor authentication process entirely. The flaw stems from the application's failure to properly validate secondary authentication factors before establishing persistent session states, allowing malicious actors to exploit a timing attack vector that occurs during session initialization.
The technical implementation of this vulnerability resides in the session management component where cookie caching is enabled without proper synchronization between authentication factors. When a user successfully authenticates with their primary credentials, the system prematurely caches the session state before verifying the second factor authentication completion. This premature caching creates a race condition where an attacker can intercept and reuse valid session tokens that were generated before the second factor verification occurred, effectively allowing unauthorized access to protected resources without completing the required multi-factor authentication workflow.
From an operational perspective this vulnerability poses significant risk to organizations relying on better-auth for their authentication infrastructure, particularly those implementing mandatory two-factor authentication policies. The impact extends beyond simple unauthorized access as it can enable privilege escalation attacks where attackers gain elevated permissions through bypassed authentication layers. Security practitioners should recognize this as a critical vulnerability that directly violates the principle of least privilege and undermines the security posture established by multi-factor authentication requirements. The vulnerability's exploitation potential aligns with attack patterns documented in the mitre ATT&CK framework under credential access and privilege escalation techniques, specifically targeting authentication bypass mechanisms.
The root cause analysis reveals a design flaw in the session validation lifecycle where the system assumes that primary credential verification alone is sufficient for session establishment. This violates security best practices outlined in industry standards including CWE-305 which addresses authentication bypass vulnerabilities, and CWE-613 which covers inadequate session management. Organizations should implement immediate mitigations including disabling cookie cache functionality when multi-factor authentication is required, or implementing proper session validation that ensures all authentication factors are verified before any session state is persisted. Additionally, security controls should enforce strict session lifecycle management that prevents premature caching of authenticated states and implements proper synchronization between authentication factor verification and session establishment processes.
Mitigation strategies should encompass both immediate remediation actions and long-term architectural improvements to prevent similar vulnerabilities in future implementations. The most effective immediate solution involves updating to better-auth version 1.4.9 or later where this vulnerability has been patched, combined with configuration reviews to ensure cookie caching is disabled for environments requiring multi-factor authentication. Organizations should also implement comprehensive monitoring of session establishment patterns and authentication factor verification sequences to detect anomalous behavior that might indicate exploitation attempts. The vulnerability serves as a reminder of the critical importance of proper session management in security-critical applications and highlights the necessity of following established security frameworks such as those defined by NIST SP 800-63B for authentication system design and implementation practices.