A vulnerability in the better-auth deviceAuthorization() plugin versions from 1.3.8-beta.3 up to, but not including, 1.7.0-rc.3 allows an attacker to trick a signed-in user into approving a device login request without showing the requesting client or requested permissions. This can lead to the attacker obtaining a live session token for the user. The issue is fixed starting with version 1.7.0-rc.3.