Technical impact
The vulnerability in better‑auth versions prior to 1.6.11 allows stale sessions to persist after a user account is deleted. When secondaryStorage is configured and storeSessionInDatabase is false, the system fails to remove cached session tokens through admin, anonymous, or SCIM endpoints. As a result, an attacker can reuse a deleted user’s session token and maintain authenticated access for up to seven days, effectively impersonating the account without the original credentials.
Affected Systems
Affected systems are installations of better‑auth with versions earlier than 1.6.11 that have secondaryStorage enabled and storeSessionInDatabase set to false. The vulnerability is present in the oauth‑provider component and applies to configurations that use the node.js platform.
Risk and Exploitability
The CVSS score of 5.1 indicates moderate severity. No EPSS score is available, but the lack of exploitation in the KEV list suggests limited known attacks. The attack vector is likely via authorized admin or SCIM deletion requests, so an attacker with sufficient privileges can delete a user and then reuse the session. The risk is medium because it requires an initial privileged action but grants extended unauthorized access for up to a week after deletion.
