CVE-2026-109346: better-auth device authorization UI misrepresentation in deviceAuthorization plugin

CVE-2026-109346 · Severity: high · CVSS 8.1 · Published 2026-10-12

better-auth is an authentication library used to sign users into applications. A flaw in its optional device login feature omits critical information about which application is requesting access and what permissions it needs, allowing attackers to trick signed-in users into approving unauthorized device codes. Once approved, the attacker receives a live session token and can read or modify any data the user's account can access.

Technologies: Better-Auth, better-auth (npm). Vendors: Better-Auth, npm.

Quick answers

Is CVE-2026-109346 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109346 being exploited in the wild.
How severe is CVE-2026-109346?
High severity, with a CVSS score of 8.1, published 12 October 2026.
Which products and versions are affected?
Better-Auth 1.3.8-beta.3 before 1.7.0-rc.3; better-auth (npm) SEMVER:introduced=1.3.8-beta.3,fixed=1.7.0-rc.3.
Is there a fix for CVE-2026-109346?
Yes. better-auth (npm): upgrade to 1.7.0-rc.3 or later. Until then: Disable the deviceAuthorization() plugin or block untrusted access to /device/code. If the plugin must remain enabled, configure a strict validateClient allowlist and build a custom approval endpoint that reads the pending request from trusted server-side storage, maps the client identifier to a display name, and shows the exact requested permissions before approval. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109346 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-109346?
Check whether you run Better-Auth or better-auth (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • better-auth (npm): upgrade to 1.7.0-rc.3 or later
    npm install better-auth@1.7.0-rc.3

Disable the deviceAuthorization() plugin or block untrusted access to /device/code. If the plugin must remain enabled, configure a strict validateClient allowlist and build a custom approval endpoint that reads the pending request from trusted server-side storage, maps the client identifier to a display name, and shows the exact requested permissions before approval.

Technical details

The deviceAuthorization plugin fails to return the requesting client_id and scope to the approval endpoint, preventing the UI from displaying which client initiated the flow. An attacker initiates a device code request via /device/code, and when a signed-in user approves the code without seeing the client details, the attacker redeems it at /device/token for a valid session token. This phishing attack requires user interaction to approve a code but requires no authentication or special privileges.

Affected products

  • better-auth better-auth 1.3.8-beta.3 before 1.7.0-rc.3

Identifiers

  • CVE-2026-109346
  • GHSA-q84f-53jg-9ppm

Timeline

  • 2026-09-28: disclosed: GitHub Security Advisory GHSA-q84f-53jg-9ppm published
  • 2026-10-12: advisory: CVE-2026-109346 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.