VYPR
← All advisories
High severity8.1NVD Advisory· Published Oct 12, 2026

CVE-2026-109346

CVE-2026-109346

Description

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.

Affected products

2
  • Better Auth/Better Authllm-fuzzy2 versions
    <1.7.0-rc.3+ 1 more
    • (no CPE)range: <1.7.0-rc.3
    • (no CPE)range: >=1.3.8-beta.3,<1.7.0-rc.3

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.