CVE-2026-45337 better-auth CVE debrief

Who should care

Users of Better Auth library versions 1.6.0 through 1.6.10 should apply patch 1.6.11 to prevent authentication bypass attacks. This vulnerability affects applications using Better Auth for authentication and authorization, particularly those with high-security requirements. Security teams and administrators responsible for maintaining and updating software dependencies should prioritize patching this vulnerability. Additionally, developers using Better Auth in their applications should review their code to ensure that they are not inadvertently introducing additional vulnerabilities.

Technical summary

The deviceAuthorization plugin in Better Auth incorrectly treats any authenticated session as the owner of pending device codes due to inadequate session validation. Specifically, the GET /device endpoint does not claim the row, and POST /device/approve and POST /device/deny endpoints short-circuit when userId is unset. This allows an authenticated attacker who obtains a valid user_code to bind the polling device to their account or deny the legitimate flow. The vulnerability is fixed in version 1.6.11.

Defensive priority

High priority to patch for authentication bypass vulnerability

Recommended defensive actions

• Apply patch version 1.6.11
• Review and update affected installations
• Monitor for suspicious authentication activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Official CVE and NVD records confirm vulnerability details. Vendor patch and advisory available. The deviceAuthorization plugin in Better Auth incorrectly treats any authenticated session as the owner of pending device codes due to inadequate session validation. Specifically, the GET /device endpoint does not claim the row, and POST /device/approve and POST /device/deny endpoints short-circuit when userId is unset. This allows an authenticated attacker who obtains a valid user_code to bind the polling device to their account or deny the legitimate flow. Users of Better Auth library versions 1.6.0 through 1.6.10 should apply patch 1.6.11 to prevent authentication bypass attacks.

Official resources