CyberRota Analysis
AI-GeneratedVersions of better-auth prior to 1.4.9 are vulnerable to a two-factor authentication bypass when the session.cookieCache feature is enabled. This flaw allows attackers with valid primary credentials to access protected routes without completing the second-factor verification due to premature session caching. Organizations utilizing affected versions should prioritize remediation to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
better-auth versions before 1.4.9 contain a two-factor authentication bypass vulnerability when session.cookieCache is enabled. Attackers with valid primary credentials can access authenticated routes without completing second-factor verification by exploiting premature session caching.