---
id: "GHSA-fvxx-76fc-893x"
page: "https://infrastack.ai/live/GHSA-fvxx-76fc-893x"
kind: "vulnerability"
aliases: ["GHSA-fvxx-76fc-893x"]
title: "better-auth: Revoked sessions can stay valid with secondary storage or the cookie cache"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "better-auth", "fixed": ["1.7.16"], "affected": ">= 0.8.1-beta.5, < 1.7.16", "ecosystem": "npm"}, {"name": "better-auth", "fixed": ["1.8.0-beta.5"], "affected": ">= 1.8.0-beta.0, < 1.8.0-beta.5", "ecosystem": "npm"}, {"name": "@better-auth/passkey", "fixed": ["1.7.16"], "affected": ">= 1.6.25, < 1.7.16", "ecosystem": "npm"}, {"name": "@better-auth/passkey", "fixed": ["1.8.0-beta.5"], "affected": ">= 1.8.0-beta.0, < 1.8.0-beta.5", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["@better-auth/passkey", "better-auth", "cwe-362", "cwe-613", "node", "package", "typescript"]
not_affected_if: ["auth-required", "cookie-cache-off", "no-secondary-storage"]
published_at: "2026-11-03T21:40:04+00:00"
first_seen_at: "2026-11-09T22:53:20+00:00"
updated_at: "2026-11-09T22:57:15+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-fvxx-76fc-893x", "first_seen_at": "2026-11-09T22:53:20+00:00"}]
exploit_sources: []
---

# better-auth: Revoked sessions can stay valid with secondary storage or the cookie cache

Link for people: https://infrastack.ai/live/GHSA-fvxx-76fc-893x (this .md is for agents)

Sessions revoked in better-auth can keep working when secondary storage is used or when the session cookie cache is on, and some routes accept a cached session to create new lasting credentials. An attacker who already holds a valid session for an account can keep access after it is revoked, but cannot get in without credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:better-auth affected >= 0.8.1-beta.5, < 1.7.16 fixed 1.7.16
- npm:better-auth affected >= 1.8.0-beta.0, < 1.8.0-beta.5 fixed 1.8.0-beta.5
- npm:@better-auth/passkey affected >= 1.6.25, < 1.7.16 fixed 1.7.16
- npm:@better-auth/passkey affected >= 1.8.0-beta.0, < 1.8.0-beta.5 fixed 1.8.0-beta.5

## How to check

- Check the installed version with `npm ls better-auth @better-auth/passkey`.
- Search your auth configuration for `secondaryStorage` and `cookieCache`.
- Check whether your app uses passkey registration, device authorization, or passwordless two-factor enrollment.

## Fix

- `better-auth` `1.7.16` (from `>= 0.8.1-beta.5, < 1.7.16`), or `1.8.0-beta.5` on the beta line (from `>= 1.8.0-beta.0, < 1.8.0-beta.5`).
- `@better-auth/passkey` `1.7.16` (from `>= 1.6.25, < 1.7.16`), or `1.8.0-beta.5` on the beta line.
- Workaround until upgrade: turn off `session.cookieCache` if revocation must be immediate, and stop using `secondaryStorage` for bulk revocation.

## Timeline

- 2026-11-09T22:53:20+00:00 ghsa-repo https://github.com/better-auth/better-auth/security/advisories/GHSA-fvxx-76fc-893x

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/better-auth/better-auth/security/advisories/GHSA-fvxx-76fc-893x

## From the sources

## Am I affected?

You are affected if you use `better-auth` with **any** of these:

- `secondaryStorage`, from 0.8.1-beta.5.
- `session.cookieCache` with passkey registration, device authorization, or passwordless two-factor enrollment, from 1.6.25.

## Summary

**Bulk revocation.** With secondary storage, two session changes at the same time could drop a session from the user's session list. Revoking all sessions or banning the user then missed it.

**Cached sessions.** With the cookie cache, a revoked session keeps working until the cache `maxAge` ends, which is documented. Some features accepted that cached session to create a passkey or a new stored session that outlived the cache.

## Impact

Both problems need an attacker who already holds a valid session for the account. They let that attacker keep access after the session is revoked. Neither problem gives access to an account without credentials.

## Patches

Upgrade `better-auth` and `@better-auth/passkey` to 1.7.16, or to 1.8.0-beta.5 on the beta line.

Passkey registration, device authorization, two-factor enrollment and verification, social account linking, and phone number changes now check the session store, even with the cookie cache on. On 1.7.16, sessions created from API keys are refused on these routes, except two-factor enrollment and phone number changes. On 1.8.0-beta.5, they are refused on all of them.

## Workarounds

Turn off `session.cookieCache` if revocation must take effect immediately. For bulk revocation, stop using `secondaryStorage` until you upgrade.

## Technical details

The secondary storage session list is updated by reading and writing it in two steps, so concurrent writers could drop a token. Bulk revocation now also records a cutoff time, and sessions created before it count as revoked even when the list missed them. The affected routes now read the session from the store instead of the cookie cache before creating a lasting credential or session.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_