CVE-2026-109346 better-auth CVE debrief

Who should care

Defenders responsible for maintaining and securing applications that use the better-auth library should be aware of this vulnerability and take steps to verify and mitigate it. This includes verifying the affected versions in their inventory, updating to 1.7.0-rc.3 or later, and monitoring for suspicious activity related to device authorization. Additionally, defenders should review and update their authentication and authorization configurations to ensure

Why it matters

The better-auth library versions 1.3.8-beta.3 before 1.7.0-rc.3 contain a UI misrepresentation vulnerability in the deviceAuthorization plugin, allowing attackers to trick signed-in users into approving a device request, potentially leading to phishing attacks. Defenders should prioritize verifying the affected versions in their inventory and updating to 1.7.0-rc.3 or later. They should also monitor for suspicious activity related to device authorization.

• Phishing attacks may be conducted using the device authorization plugin.
• Defenders should verify the affected versions in their inventory.
• Defenders should monitor for suspicious activity related to device authorization.
• Defenders should update to 1.7.0-rc.3 or later to mitigate the vulnerability.

Technical summary

The better-auth library versions 1.3.8-beta.3 before 1.7.0-rc.3 contain a UI misrepresentation vulnerability in the deviceAuthorization plugin. This vulnerability allows attackers to start a device request via /device/code, trick signed-in users into approving the code, and then redeem it at /device/token for a live session token. The vulnerability is caused by the deviceAuthorization plugin omitting the requesting client_id and scope in the GET /device request. Defenders should prioritize verifying the affected versions in their inventory and updating to 1.7.0-rc.3 or later.

Defensive priority

Defenders should prioritize verifying the affected versions in their inventory and updating to 1.7.0-rc.3 or later. They should also monitor for suspicious activity related to device authorization.

Recommended defensive actions

• Verify the version of better-auth in your inventory and update to 1.7.0-rc.3 or later if necessary.
• Monitor for suspicious activity related to device authorization.
• Review and update your authentication and authorization configurations.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details about the vulnerability, but there is limited information about potential exploits or victims. The vulnerability was reported by a third-party researcher and is based on limited information. The better-auth library is widely used in various applications, and defenders should verify the affected versions in their inventory. The CVE record has not been modified since its publication on 2026-10-12T16:05:30.595Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.