CVE-2026-45337 Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

🗓️ 15 Jul 2026 17:31:44Reported by GitHub_MType

CVE-2026-45337: Better Auth allows an authenticated attacker to bind or deny a pending device code; fixed in 1.6.11.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-45337	15 Jul 202617:31	–	attackerkb
CVE	CVE-2026-45337	15 Jul 202617:31	–	cve
EUVD	EUVD-2026-44743	15 Jul 202617:31	–	euvd
Github Security Blog	Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending	4 Jun 202614:55	–	github
NVD	CVE-2026-45337	15 Jul 202618:16	–	nvd
OSV	GHSA-CQ3F-VC6P-68FH Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending	4 Jun 202614:55	–	osv
Positive Technologies	PT-2026-46307	4 Jun 202600:00	–	ptsecurity
Snyk	Improper Authorization	4 Jun 202614:55	–	snyk
vulnersOsv	@agent-native/core (>=0.26.5 <=0.47.1), @intlayer/backend (=8.7.0-canary.0) +6 more potentially affected by CVE-2026-45337 via better-auth (>=1.6.0 <=1.6.10)	4 Jun 202614:55	–	vulnersosv
vulnersOsv	@agent-native/core (>=0.26.5 <=0.47.1), @intlayer/backend (=8.7.0-canary.0) +6 more potentially affected by CVE-2026-45337 via better-auth (>=1.6.0 <=1.6.10)	4 Jun 202614:55	–	vulnersosv

[
  {
    "vendor": "better-auth",
    "product": "better-auth",
    "versions": [
      {
        "version": ">= 1.6.0, < 1.6.11",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7
github	www.github.com/better-auth/better-auth/releases/tag/v1.6.11
github	www.github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68fh
github	www.github.com/better-auth/better-auth/pull/9573

15 Jul 2026 17:31Current

CVSS 3.17.6

EPSS0.00017