Better Auth better-auth: UI misrepresentation in device authorization approval
Summary
The deviceAuthorization plugin of better-auth 1.3.8-beta.3 up to 1.7.0-rc.3 does not show the approval page the requesting client ID and requested scope. An attacker can start a device request, trick a signed-in user into approving the code, and then redeem it for a live session token of that user. The attack requires the opt-in plugin, an application that accepts the returned session token, and a user who actively approves the request.
Affected
- better-auth from 1.3.8-beta.3 before 1.7.0-rc.3, when the deviceAuthorization() plugin is enabled
- All 1.6 releases are affected
Fixed in
- Fixed in better-auth 1.7.0-rc.3; upgrade to better-auth 1.7.0 or later
- No 1.6 release contains the fix
Workaround
- Disable deviceAuthorization() or block untrusted access to /device/code
- A strict validateClient allowlist limits who can start the flow but does not fix the missing approval information
- Users should reject device requests they did not expect and approve only when the same code is visible on a device they hold
Exploitation
- No evidence of exploitation in the wild found in research; CISA KEV not checked
- No public proof of concept found
- CISA SSVC assessment: exploitation none, automatable no
- EPSS 0.00278 in a secondary source (unverified)
Our recommendation
- Check whether better-auth is used and whether deviceAuthorization() is registered, including in the auth configuration
- If the plugin is enabled, plan and test the upgrade to 1.7.0 or later, including the database migration (MySQL and SQL Server: device and user code columns as strings of at most 191 characters)
- If the plugin is not used, document it as not affected and monitor the advisory
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-q84f-53jg-9ppm github.com
- VulnCheck advisory www.vulncheck.com
- OSV GHSA-q84f-53jg-9ppm osv.dev
- better-auth v1.7.0-rc.3 release notes github.com
- better-auth 1.7 RC blog post better-auth.com
- GitLab advisory GHSA-q84f-53jg-9ppm advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:52.
Original description (NVD)
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.