Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.6
CVE-2026-45337: Better Auth: Device Authorization Flaw in Older Versions
CVE-2026-45337 · published 3 months ago
Summary
Better Auth's device authorization plugin in versions 1.6.0 to 1.6.10 has a security flaw. If a third party can see a user's verification code, they can hijack the account or block the legitimate user. To fix this, update to version 1.6.11 or later, or use workarounds if an update is not possible.
What to do
- Update GitHub Actions better-auth to version 1.6.11.
- Update better-auth better_auth to version 1.6.11 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | better-auth |
>= 1.6.0, < 1.6.11 Fix: upgrade to 1.6.11
|
| – | better-auth | better-auth | >= 1.6.0, < 1.6.11 |
| – | better-auth | better_auth |
>= 1.6.0, < 1.6.11 cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:* |
Original advisory text
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker's account or deny the legitimate flow. This issue is fixed in version 1.6.11.
References
- https://github.com/better-auth/better-auth/releases/tag/v1.6.11 URL
- https://github.com/better-auth/better-auth/pull/9573 Patch
- https://github.com/advisories/GHSA-cq3f-vc6p-68fh
- https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45337... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-45337 Vendor Advisory
- https://github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-285Improper Authorization
CWE-345Insufficient Verification of Data Authenticity
CWE-639Authorization Bypass Through User-Controlled Key
CWE-863Incorrect Authorization
Timeline
Published15 Jul 2026
Updated29 Oct 2026
First seen4 Jun 2026
Track software like this
Free during beta