CVE-2026-45337

Name of the Vulnerable Software and Affected Versions Better Auth versions 1.6.0 through 1.6.10

Description The deviceAuthorization plugin incorrectly treats any authenticated session as the owner of any pending device code. This occurs because the GET /device endpoint does not claim the row, and the POST /device/approve and POST /device/deny endpoints short-circuit when the userId variable is unset. An authenticated attacker who obtains a valid user code can bind the polling device to their own account or deny the legitimate authentication flow. This issue is a form of Session Spying, where a malicious party hijacks a session by completing authorization before the legitimate user.

Recommendations Upgrade to version 1.6.11 or later. As a temporary workaround, disable the deviceAuthorization plugin by removing it from the plugins array. As a temporary workaround, add a before hook on POST /device/approve and POST /device/deny to track which session called GET /device for each user code and reject calls from different sessions. As a temporary workaround, reduce the exploitation window by shortening the pending lifetime of device codes using the expiresIn plugin option.