UI Misrepresentation Vulnerability in better-auth Device Authorization Plugin
CVE-2026-109346

8.5HIGH

Key Information:

Vendor

Better-auth

Status
Better-auth
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109346?

The better-auth device authorization plugin exhibits a UI misrepresentation vulnerability that permits attackers to initiate device requests without proper client identification and scope verification. By exploiting this flaw, attackers can trick logged-in users into approving requests using a device code and subsequently redeem the code for a valid session token, leading to unauthorized access.

Affected Version(s)

better-auth 1.3.8-beta.3 < 1.7.0-rc.3

better-auth 1.7.0-rc.3

References

https://github.com/better-auth/better-auth/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/better-auth-1.3.8-be...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

XlabAITeam
liangjs
.