CVE-2026-109346

8.1 HIGHpublic exploit available

Published 2026-10-12 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses

CWE-451

Public exploit & PoC references

https://github.com/better-auth/better-auth/security/advisories/GHSA-q84f-53jg-9ppm

All references

https://github.com/better-auth/better-auth/security/advisories/GHSA-q84f-53jg-9ppm
https://www.vulncheck.com/advisories/better-auth-1.3.8-beta.3-before-1.7.0-rc.3-device-authorization-phishing-via-device

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100822
MEDIUMCVE-2026-100823PoC
MEDIUMCVE-2026-102305
MEDIUMCVE-2026-102312
MEDIUMCVE-2026-102314
LOWCVE-2026-105043
MEDIUMCVE-2026-106179
MEDIUMCVE-2026-106182

Related by shared AI tags and CWE weakness class. Browse the full archive.