better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device… (CVE-2026-109346)

The vulnerability in better-auth (CVE-2026-109346) affects versions from 1.3.8-beta.3 before 1.7.0-rc.3. It is a UI misrepresentation issue in the deviceAuthorization plugin where the GET /device endpoint does not display the requesting client_id and scope. This omission enables attackers to initiate a device request via /device/code, deceive signed-in users into approving the code, and subsequently redeem it at /device/token to obtain a live session token. The CVSS 3.1 score is 8.1 (high severity), indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity.

Successful exploitation allows an attacker to obtain a live session token by tricking a signed-in user into approving a device authorization code. This leads to unauthorized access with high confidentiality and integrity impact, potentially compromising user sessions without requiring prior privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious when approving device authorization requests and verify the legitimacy of client requests. Monitor vendor channels for updates and apply patches promptly once released.