Read the docs
TI-2026-33133 Aliases CVE-2026-45337GHSA-cq3f-vc6p-68fh

Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

Priority LOW 35CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker's account or deny the legitimate flow. This issue is fixed in version 1.6.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Fix Fixed better-auth (better-auth): 1.6.11better-auth (npm): 1.6.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
better-authbetter-auth1.6.0 to before 1.6.111.6.11Patch availableCNA
—better-auth (npm)1.6.0 to before 1.6.111.6.11Patch availableGHSA-cq3f-vc6p-68fh
  • better-auth Vendorbetter-auth Affected 1.6.0 to before 1.6.11 Fixed in 1.6.11 Patch available CNA
  • better-auth (npm) Vendor— Affected 1.6.0 to before 1.6.11 Fixed in 1.6.11 Patch available GHSA-cq3f-vc6p-68fh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*1.6.0 to before 1.6.11Vulnerablebetter-auth
  • cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:* Versions 1.6.0 to before 1.6.11 Vulnerable ·better-auth

Remediation

  • Fix · CNA better-auth (better-auth) Fixed in 1.6.11
  • Fix · GHSA-cq3f-vc6p-68fh better-auth (npm) Fixed in 1.6.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45337
  2. 2026-10-03 Alias added: GHSA-cq3f-vc6p-68fh

References

Patch 2

Advisory 1

Other 2

  • TI-2025-20000 Beter Auth has an Open Redirect via Scheme-Less Callback Parameter CVSS 4.0MEDIUM 6.9
  • TI-2026-38586 Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins CVSS 4.0CRITICAL 9.1
  • TI-2026-38587 Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration CVSS 3.1CRITICAL 9.6
  • TI-2026-38591 Better Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family Forking CVSS 3.1HIGH 8.1
  • TI-2026-38590 Better Auth: Account takeover via OAuth auto-link to unverified pre-registered email CVSS 3.1HIGH 8.3
  • TI-2026-38592 Better Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code Redemption CVSS 4.0HIGH 7.6
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences