Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the incomplete cleanup of user sessions upon user deletion across multiple modules of the better-auth library. When secondaryStorage (like Redis) is used for session management and database session storage is disabled, several user deletion functions (removeUser in the admin plugin, the self-delete endpoint and after-link hook in the anonymous plugin, and deleteSCIMUser in the SCIM plugin) failed to call the necessary function to delete sessions from this secondary storage. The patch commit a26333b5fb1a044e76c18385441d3ecc2240ab70 addresses this by adding a call to deleteSessions before the deleteUser call in each of the identified vulnerable functions. This ensures that when a user is deleted, their sessions are immediately invalidated, preventing unauthorized access with stale session tokens.
removeUserpackages/better-auth/src/plugins/admin/routes.ts
anonymouspackages/better-auth/src/plugins/anonymous/index.ts
deleteSCIMUserpackages/scim/src/routes.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| better-auth | npm | >= 0.3.4, < 1.6.11 | 1.6.11 |
| @better-auth/scim | npm | >= 1.6.0, < 1.6.11 | 1.6.11 |
adminremoveUserpackages/better-auth/src/plugins/admin/routes.ts:1463anonymous plugin's self-delete endpoint (packages/better-auth/src/plugins/anonymous/index.ts:222).anonymous plugin's after-link hook (packages/better-auth/src/plugins/anonymous/index.ts:325).@better-auth/scim's DELETE /scim/v2/Users/:userId (packages/scim/src/routes.ts:1019).Working callers that already do the right thing: the core /delete-user self-delete and /delete-user/callback (packages/better-auth/src/api/routes/update-user.ts:551).
The fix shape extends each vulnerable caller to invoke deleteSessions(userId) before deleteUser(userId). The architectural follow-up centralizes the cleanup inside deleteUser itself or introduces a single deleteUserAndSessions orchestrator so future callers cannot regress this contract.
Fixed in better-auth@<patched-version> and @better-auth/scim@<patched-version>. All four user-deletion call sites now invoke deleteSessions(userId) before deleteUser(userId) so sessions are evicted from secondary storage at the same time the user row is removed.
If users cannot upgrade immediately:
session.storeSessionInDatabase: true. Subsequent user-delete writes reach the session table and the database cascade removes rows. Increases write volume for high-throughput sessions but eliminates the gap.auth.api.removeUser, also call auth.api.revokeUserSessions({ body: { userId } }), which uses deleteSessions internally.auth.api.revokeUserSessions(...) after the SCIM DELETE.onLinkAccount, explicitly call internalAdapter.deleteSessions(anonymousUser.user.id) before allowing the new session to be issued.getSessionFromCtx until the session TTL elapses (default 7 days). Within that window, the deleted user retains their pre-existing read and write surface.Reported by @iruizsalinas.