CVE-2026-109346
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in…
- Risk score
- 58/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/t…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.7.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
- Remotely exploitable without logging in
References
Original description
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.
Last activity 12 Oct 2026. Patch Forecast updates every hour.