Is CVE-2026-67337 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-67337?

CVE-2026-67337 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-67337

Description

better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.