6 matches found
CVE-2026-109346
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting clientid and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then...
CVE-2026-109346 better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting clientid and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then...
EUVD-2026-97648
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting clientid and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then...
CVE-2026-109346
The better-auth library versions 1.3.8-beta.3 before 1.7.0-rc.3 is vulnerable to a UI misrepresentation issue within the deviceAuthorization plugin. The root cause is that the GET /device endpoint fails to include the requesting client_id and scope . This allows an attacker to initiate a device r...
CVE-2026-109346: User Interface (UI) Misrepresentation of Critical Information
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting clientid and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then...
CVE-2026-45337: Improper Authorization
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny...