Tridecent

**Name of the Vulnerable Software and Affected Versions** better-auth versions prior to 1.4.9 **Description** A two-factor authentication (2FA) bypass occurs when `session.cookieCache` is enabled. The issue arises because the session generated during the initial sign-in step may be cached as valid before the second-factor verification is completed. Consequently, subsequent session lookups may return this cached session without re-evaluating the 2FA requirement, allowing an attacker with valid primary credentials to access authenticated routes without completing the second authentication factor. **Recommendations** Update to version 1.4.9 or later. As a temporary workaround, disable `session.cookieCache` when using two-factor authentication.