better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-109346 · Microsoft / collected KEV context

EUVD-2026-97648

GHSA-v9c8-wq66-wf8g

GHSA-q84f-53jg-9ppm

cve-program · CVE-2026-109346

• https://github.com/better-auth/better-auth/security/advisories/GHSA-q84f-53jg-9ppm
• https://www.vulncheck.com/advisories/better-auth-1.3.8-beta.3-before-1.7.0-rc.3-device-authorization-phishing-via-device

euvd · EUVD-2026-97648

• https://github.com/better-auth/better-auth/security/advisories/GHSA-q84f-53jg-9ppm
• https://www.vulncheck.com/advisories/better-auth-1.3.8-beta.3-before-1.7.0-rc.3-device-authorization-phishing-via-device

nvd · CVE-2026-109346

• https://github.com/better-auth/better-auth/security/advisories/GHSA-q84f-53jg-9ppm
• https://www.vulncheck.com/advisories/better-auth-1.3.8-beta.3-before-1.7.0-rc.3-device-authorization-phishing-via-device

osv · GHSA-q84f-53jg-9ppm

• https://github.com/better-auth/better-auth/security/advisories/GHSA-q84f-53jg-9ppm
• https://github.com/better-auth/better-auth/commit/f68044dcfbd9fb83763249ed9509cfacbcce47be
• https://github.com/better-auth/better-auth
• https://github.com/better-auth/better-auth/releases/tag/v1.7.0-rc.3

• better-auth: Device login approval does not show the requesting client or permissions · Newly collected advisory · 27 Oct 2026