CVE-2026-109346: better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting clientid and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the better-auth deviceAuthorization plugin in versions from 1.3.8-beta.3 before 1.7.0-rc.3 are exposed. The affected endpoint is the plugin's GET /device authorization page.
What does an attacker need to exploit it?
An attacker can initiate a device authorization request through /device/code and must persuade a signed-in user to approve the resulting code. No attacker privileges are required, but exploitation requires user interaction.
What is the impact if a user approves a malicious device code?
The attacker can redeem the approved request at /device/token and obtain a live session token. This can expose the affected user's authenticated session.
How can exposure be reduced before upgrading?
The provided information identifies the deviceAuthorization plugin as the affected component. Reducing or disabling access to its device authorization flow, including the /device, /device/code, and /device/token endpoints, would remove the described attack path until an upgrade is possible.