{"id":"EUVD-2026-97648","enisaUuid":"0946ea0b-52ce-3173-9ff9-c581db2e0133","description":"better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.","datePublished":"Oct 12, 2026, 4:05:30 PM","dateUpdated":"Oct 26, 2026, 4:46:48 PM","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-q84f-53jg-9ppm\nhttps://www.vulncheck.com/advisories/better-auth-1.3.8-beta.3-before-1.7.0-rc.3-device-authorization-phishing-via-device\n","aliases":"CVE-2026-109346\nGHSA-v9c8-wq66-wf8g\n","assigner":"VulnCheck","epss":0.28,"enisaIdProduct":[{"id":"ccc329cf-d9b7-33bb-97f1-da7ca216c6af","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"1.3.8-beta.3 \u003c1.7.0-rc.3"}],"enisaIdVendor":[{"id":"8c5961e0-7611-3935-8dd2-a9f0cc3bee7d","vendor":{"name":"better-auth"}}],"enisaIdVulnerability":[{"id":"1164f461-295f-3743-aa67-7a0e1c131ba9","vulnerability":{"id":"GHSA-v9c8-wq66-wf8g","description":"better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.","datePublished":"Oct 12, 2026, 6:31:51 PM","dateUpdated":"Oct 12, 2026, 6:31:51 PM","baseScore":0.0,"references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-q84f-53jg-9ppm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-109346\nhttps://www.vulncheck.com/advisories/better-auth-1.3.8-beta.3-before-1.7.0-rc.3-device-authorization-phishing-via-device\n","enisa_id":"EUVD-2026-97648\n","aliases":"CVE-2026-109346\nGHSA-v9c8-wq66-wf8g\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"91441866-26b3-3af0-8af1-283a5008baed","vulnerability":{"id":"CVE-2026-109346","description":"better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token.","datePublished":"Oct 12, 2026, 4:05:30 PM","dateUpdated":"Oct 26, 2026, 4:46:48 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/better-auth/better-auth/security/advisories/GHSA-q84f-53jg-9ppm\nhttps://www.vulncheck.com/advisories/better-auth-1.3.8-beta.3-before-1.7.0-rc.3-device-authorization-phishing-via-device\n","enisa_id":"EUVD-2026-97648\n","assigner":"VulnCheck","epss":0.28,"dataProcessed":"Oct 28, 2026, 2:00:33 AM","vulnerabilityProduct":[{"id":"820d9d4f-f227-3b40-9e98-417099340413","product":{"name":"better-auth","vendor":{"name":"better-auth"}},"product_version":"1.3.8-beta.3 \u003c1.7.0-rc.3"}],"vulnerabilityVendor":[{"id":"9c8a6890-3575-3e6b-a242-7683375bc0b7","vendor":{"name":"better-auth"}}]}}],"enisaIdAdvisory":[]}