Description
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| better-auth | better-auth | < 1.4.9 | 1.4.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | better-auth | < 1.4.9 | 1.4.9 | GHSA-xg6x-h9c9-2m83 |
References
- GitHub Security Advisory (GHSA-xg6x-h9c9-2m83) vendor-advisory
- VulnCheck Advisory: better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache third-party-advisory