CVE-2026-67337

better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching...

Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

Am I affected? Users are affected if all of the following are true: - Their project depends on @better-auth/oauth-provider at a version = 1.6.0, = 1.4.8-beta.7, 1.6.0. - At least one OAuth client served by their application's authorization server requests the offlineaccess scope, so refresh token...

PT-2026-60904

Am I affected? Users are affected if all of the following are true: - They configure secondaryStorage on betterAuth... Redis, KV, or any external session cache. - session.storeSessionInDatabase is left unset or set to false the default. - Their application's deployment uses one or more of: - The...