A vulnerability in better-auth causes stale user sessions to persist after user deletion when using external session caches and the session is not stored in the database. This affects user deletion flows in the admin, anonymous, and SCIM plugins, allowing deleted users' sessions to remain valid until the session TTL expires (default 7 days). The issue is fixed in patched versions of better-auth and @better-auth/scim, which ensure sessions are deleted before user records. Workarounds include enabling session storage in the database or explicitly revoking sessions in code. The impact is limited to session persistence post-deletion, with no known exploits in the wild.