CVE-2026-67337

CVE-2026-67337 affects better-auth versions before 1.4.9. The issue is a two‑factor authentication bypass when session.cookieCache is enabled: attackers with valid primary credentials can reach authenticated routes without completing second‑factor verification by exploiting premature session cach...