Login Request a demo
High severity · published Jul 15, 2026
CVE-2026-45337
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
7.6
CVSS
0.2%
EPSS
No
On KEV
Description
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker's account or deny the legitimate flow. This issue is fixed in version 1.6.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BE
better-auth · better-auth
>= 1.6.0, < 1.6.11 · source: vendor
BA
Better Auth · Better-auth
1.6.0 before 1.6.11 · source: NVD
Affected product
BE
better-auth
better-auth
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45337
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45337
Patch
https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7
Issue Tracking
https://github.com/better-auth/better-auth/pull/9573
Release Notes
https://github.com/better-auth/better-auth/releases/tag/v1.6.11
Mitigation
https://github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68fh
More from better-auth
9.6
CVE-2026-53513
Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration
9.3
CVE-2025-61928
Better Auth: Unauthenticated API key creation through api-key plugin
9.1
CVE-2026-114607
better-auth: OAuth state can be used as a Magic Link to sign in as another user
9.1
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
9.1
CVE-2026-53512
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins