GHSA-xg6x-h9c9-2m83: Better auth Authentication Bypass Vulnerability

CRITICAL
Share
CWE-288
Published
Advisory Summary

GHSA-xg6x-h9c9-2m83 is a CRITICAL authentication bypass vulnerability (CWE-288: Authentication Bypass Using an Alternate Path or Channel) affecting Better auth libraries in the npm ecosystem. The issue involves better auth has two-factor authentication bypass via premature session caching (session.cookiecache). Remediation is available by upgrading affected packages to version 1.4.9.

GHSA-xg6x-h9c9-2m83 at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-xg6x-h9c9-2m83
Severity CRITICAL
CVSS v3.1 Base Score N/A
CWE Classification CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected Product Better auth
Package Ecosystem npm
Published Date
Last Updated

How to Fix GHSA-xg6x-h9c9-2m83

To remediate this vulnerability, upgrade all affected Better auth dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

better-auth fixed: 1.4.9 
npm install better-auth@1.4.9
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls better-auth

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-xg6x-h9c9-2m83, inspect your project dependencies using npm:

npm ls better-auth

Analyze the terminal output to locate any version of Better auth in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.4.9), your application is affected.

Note: The npm ls better-auth command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel, where the product requires authentication, but the product has an alternate path or channel that does not require authentication. In Better auth, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary Under certain configurations, sessions may be considered valid before two-factor authentication (2FA) is fully completed. This can allow access to authenticated routes without verifying the second factor. --- ### Description When two-factor authentication is enabled, the authentication flow correctly identifies users who require additional verification and defers full authentication until the second factor is completed. However, when `session.cookieCache` is enabled, the session generated during the initial sign-in step may be cached as valid **prior to 2FA verification**. Subsequent session lookups may then return this cached session without re-evaluating the 2FA requirement. This results in a situation where session validity can be established before all authentication constraints are satisfied. --- ### Impact An attacker (or user) with valid primary credentials may gain access to protected application routes without completing the required second authentication factor. Any application using `better-auth` with both two-factor authentication and session cookie caching enabled may be affected. --- ### Mitigation * Upgrade to a version of `better-auth` that includes the fix for this issue. * Ensure that session caching does not treat sessions as fully authenticated until all required authentication steps, including 2FA, are completed. * As a temporary workaround, disable `session.cookieCache` when using two-factor authentication.

GHSA-xg6x-h9c9-2m83 Affected Better auth Versions

1 component(s)
Fixed Versions:
1.4.9
Product / Package Ecosystem Affected Versions Fixed Version
better-auth
npm/better-auth
npm
< 1.4.9
1.4.9

References

GitHub Advisory / Wiki ADVISORY
https://github.com/better-auth/better-auth/security/advisories/GHSA-xg6x-h9c9-2m83
Better auth Source Repository REPOSITORY
https://github.com/better-auth/better-auth

Frequently Asked Questions

What is GHSA-xg6x-h9c9-2m83?
GHSA-xg6x-h9c9-2m83 is a security vulnerability in Better auth involving Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) under CWE-288: Authentication Bypass Using an Alternate Path or Channel.
Which Better auth versions are affected?
Affected versions include releases prior to 1.4.9 across affected packages: better-auth.
What version fixes GHSA-xg6x-h9c9-2m83?
Upgrading to 1.4.9 (or the latest patched release for your respective branch) resolves the vulnerability.
Is better-auth affected?
Yes, better-auth is affected in releases prior to 1.4.9. Upgrade your dependency to 1.4.9 or later.
What CWE is associated with GHSA-xg6x-h9c9-2m83?
GHSA-xg6x-h9c9-2m83 is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel (The product requires authentication, but the product has an alternate path or channel that does not require authentication.).
How can I check npm dependencies for GHSA-xg6x-h9c9-2m83?
Run the dependency tree command: 'npm ls better-auth'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xg6x-h9c9-2m83",
  "modified" : "2026-04-03T03:29:59Z",
  "published" : "2026-04-03T03:29:59Z",
  "aliases" : [ ],
  "summary" : "Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)",
  "details" : "### Summary\n\nUnder certain configurations, sessions may be considered valid before two-factor authentication (2FA) is fully completed. This can allow access to authenticated routes without verifying the second factor.\n\n---\n\n### Description\n\nWhen two-factor authentication is enabled, the authentication flow correctly identifies users who require additional verification and defers full authentication until the second factor is completed.\n\nHowever, when `session.cookieCache` is enabled, the session generated during the initial sign-in step may be cached as valid **prior to 2FA verification**. Subsequent session lookups may then return this cached session without re-evaluating the 2FA requirement.\n\nThis results in a situation where session validity can be established before all authentication constraints are satisfied.\n\n---\n\n### Impact\n\nAn attacker (or user) with valid primary credentials may gain access to protected application routes without completing the required second authentication factor.\n\nAny application using `better-auth` with both two-factor authentication and session cookie caching enabled may be affected.\n\n---\n\n### Mitigation\n\n* Upgrade to a version of `better-auth` that includes the fix for this issue.\n* Ensure that session caching does not treat sessions as fully authenticated until all required authentication steps, including 2FA, are completed.\n* As a temporary workaround, disable `session.cookieCache` when using two-factor authentication.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "better-auth"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.4.9"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/better-auth/better-auth/security/advisories/GHSA-xg6x-h9c9-2m83"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/better-auth/better-auth"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-288" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-04-03T03:29:59Z",
    "nvd_published_at" : null
  }
}