Vulnerability-Lookup

CVE-2026-45337 (GCVE-0-2026-45337)

Vulnerability from cvelistv5 – Published: 2026-07-15 17:31 – Updated: 2026-07-15 18:02

Title

Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

Summary

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker's account or deny the legitimate flow. This issue is fixed in version 1.6.11.

Severity

7.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-285 - Improper Authorization
CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/better-auth/better-auth/securi…	x_refsource_CONFIRM
https://github.com/better-auth/better-auth/pull/9573	x_refsource_MISC
https://github.com/better-auth/better-auth/commit…	x_refsource_MISC
https://github.com/better-auth/better-auth/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
better-auth	better-auth	Affected: >= 1.6.0, < 1.6.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45337",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T18:02:43.206553Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T18:02:58.506Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "better-auth",
          "vendor": "better-auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.6.0, \u003c 1.6.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker\u0027s account or deny the legitimate flow. This issue is fixed in version 1.6.11."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T17:31:44.983Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68fh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68fh"
        },
        {
          "name": "https://github.com/better-auth/better-auth/pull/9573",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/better-auth/better-auth/pull/9573"
        },
        {
          "name": "https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7"
        },
        {
          "name": "https://github.com/better-auth/better-auth/releases/tag/v1.6.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/better-auth/better-auth/releases/tag/v1.6.11"
        }
      ],
      "source": {
        "advisory": "GHSA-cq3f-vc6p-68fh",
        "discovery": "UNKNOWN"
      },
      "title": "Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45337",
    "datePublished": "2026-07-15T17:31:44.983Z",
    "dateReserved": "2026-05-11T21:40:08.176Z",
    "dateUpdated": "2026-07-15T18:02:58.506Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45337",
      "date": "2026-06-14",
      "epss": "0.00017",
      "percentile": "0.0446"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45337\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-15T18:16:45.580\",\"lastModified\":\"2026-07-15T19:17:15.423\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker\u0027s account or deny the legitimate flow. This issue is fixed in version 1.6.11.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"better-auth\",\"product\":\"better-auth\",\"versions\":[{\"version\":\"\u003e= 1.6.0, \u003c 1.6.11\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.1,\"impactScore\":5.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-15T18:02:43.206553Z\",\"id\":\"CVE-2026-45337\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"},{\"lang\":\"en\",\"value\":\"CWE-345\"}]}],\"references\":[{\"url\":\"https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/better-auth/better-auth/pull/9573\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/better-auth/better-auth/releases/tag/v1.6.11\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68fh\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45337\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-15T18:02:43.206553Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-15T18:02:48.243Z\"}}], \"cna\": {\"title\": \"Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending\", \"source\": {\"advisory\": \"GHSA-cq3f-vc6p-68fh\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"better-auth\", \"product\": \"better-auth\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.6.0, \u003c 1.6.11\"}]}], \"references\": [{\"url\": \"https://github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68fh\", \"name\": \"https://github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68fh\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/better-auth/better-auth/pull/9573\", \"name\": \"https://github.com/better-auth/better-auth/pull/9573\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7\", \"name\": \"https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/better-auth/better-auth/releases/tag/v1.6.11\", \"name\": \"https://github.com/better-auth/better-auth/releases/tag/v1.6.11\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker\u0027s account or deny the legitimate flow. This issue is fixed in version 1.6.11.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285: Improper Authorization\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-345\", \"description\": \"CWE-345: Insufficient Verification of Data Authenticity\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-15T17:31:44.983Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45337\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-15T18:02:58.506Z\", \"dateReserved\": \"2026-05-11T21:40:08.176Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-15T17:31:44.983Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45337

Vulnerability from fkie_nvd - Published: 2026-07-15 18:16 - Updated: 2026-07-15 19:17

Severity

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7
	security-advisories@github.com	https://github.com/better-auth/better-auth/pull/9573
	security-advisories@github.com	https://github.com/better-auth/better-auth/releases/tag/v1.6.11
	security-advisories@github.com	https://github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68fh

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "better-auth",
          "vendor": "better-auth",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.6.0, \u003c 1.6.11"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker\u0027s account or deny the legitimate flow. This issue is fixed in version 1.6.11."
    }
  ],
  "id": "CVE-2026-45337",
  "lastModified": "2026-07-15T19:17:15.423",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45337",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-15T18:02:43.206553Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-15T18:16:45.580",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/better-auth/better-auth/commit/99a254a79b59d5a3f5ca2123260118cddb5beed7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/better-auth/better-auth/pull/9573"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/better-auth/better-auth/releases/tag/v1.6.11"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68fh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CQ3F-VC6P-68FH

Vulnerability from github – Published: 2026-06-04 14:55 – Updated: 2026-06-09 11:58

Summary

Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

Details

Am I affected?

You are affected if all of the following are true:

You use better-auth at a version >= 1.6.0, < 1.6.11.
The deviceAuthorization plugin is enabled in your auth config (deviceAuthorization() in your plugins array).
A third party can observe a pending user code before the legitimate user completes verification.

The standard device-flow UX displays user codes to humans, so realistic exposure includes shoulder-surfing, screen-share, voice or video calls, support-chat transcripts, referrer headers, and shared logs.

If your application does not enable the deviceAuthorization plugin, you are not affected.

Fix:

Upgrade to better-auth@1.6.11 or later.
If you cannot upgrade, see workarounds below.

Summary

Better Auth's deviceAuthorization plugin treated any authenticated session as the owner of any pending device code. The ownership gate on POST /device/approve and POST /device/deny short-circuited whenever the row's userId was unset, and the GET /device verification handler did not claim the row. An authenticated attacker who learned a valid user_code before the legitimate user completed approval could bind the polling device to the attacker's account or deny the legitimate flow.

Details

The device authorization flow binds the polling device to the user who entered the user code on the verification page. In affected versions, the plugin only created that binding at approve or deny time, with no claim at the verification step. The ownership check at approve and deny short-circuited when the owner was missing, accepting any authenticated caller instead of rejecting the request.

The fix changes GET /device to claim the pending row for the calling session. The approve and deny gates now require strict equality between the row's owner and the calling session. RFC 8628 §5.5 covers this risk class as Session Spying: a malicious party can hijack a session by completing authorization before the legitimate initiating user does.

Patches

Fixed in better-auth@1.6.11. After the patch, GET /device claims the pending row for the calling session, and POST /device/approve and POST /device/deny reject calls whose session does not match the claimed owner. Custom verification pages must serve GET /device to an authenticated session for the flow to succeed.

Workarounds

If you cannot upgrade immediately:

Disable the plugin if you do not use the device flow: remove deviceAuthorization() from your plugins array.
Add a before hook on POST /device/approve and POST /device/deny that tracks which session called GET /device for each user code, and rejects calls from a different session.
Shorten the pending lifetime of device codes via the expiresIn plugin option to reduce the exploitation window.

Impact

Account takeover on the polling device: the attacker's session becomes the device's session, so the device operates as the attacker.
Denial of the legitimate sign-in: the attacker can mark the code as denied, blocking the victim's flow.

Credit

Reported by Quikturn Security Team.

References

Severity

7.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "better-auth"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0"
            },
            {
              "fixed": "1.6.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45337"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-345",
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-04T14:55:52Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Am I affected?\n\nYou are affected if all of the following are true:\n\n- You use `better-auth` at a version `\u003e= 1.6.0, \u003c 1.6.11`.\n- The `deviceAuthorization` plugin is enabled in your auth config (`deviceAuthorization()` in your `plugins` array).\n- A third party can observe a pending user code before the legitimate user completes verification.\n\nThe standard device-flow UX displays user codes to humans, so realistic exposure includes shoulder-surfing, screen-share, voice or video calls, support-chat transcripts, referrer headers, and shared logs.\n\nIf your application does not enable the `deviceAuthorization` plugin, you are not affected.\n\nFix:\n\n1. Upgrade to `better-auth@1.6.11` or later.\n2. If you cannot upgrade, see workarounds below.\n\n### Summary\n\nBetter Auth\u0027s `deviceAuthorization` plugin treated any authenticated session as the owner of any pending device code. The ownership gate on `POST /device/approve` and `POST /device/deny` short-circuited whenever the row\u0027s `userId` was unset, and the `GET /device` verification handler did not claim the row. An authenticated attacker who learned a valid `user_code` before the legitimate user completed approval could bind the polling device to the attacker\u0027s account or deny the legitimate flow.\n\n### Details\n\nThe device authorization flow binds the polling device to the user who entered the user code on the verification page. In affected versions, the plugin only created that binding at approve or deny time, with no claim at the verification step. The ownership check at approve and deny short-circuited when the owner was missing, accepting any authenticated caller instead of rejecting the request.\n\nThe fix changes `GET /device` to claim the pending row for the calling session. The approve and deny gates now require strict equality between the row\u0027s owner and the calling session. RFC 8628 \u00a75.5 covers this risk class as Session Spying: a malicious party can hijack a session by completing authorization before the legitimate initiating user does.\n\n### Patches\n\nFixed in `better-auth@1.6.11`. After the patch, `GET /device` claims the pending row for the calling session, and `POST /device/approve` and `POST /device/deny` reject calls whose session does not match the claimed owner. Custom verification pages must serve `GET /device` to an authenticated session for the flow to succeed.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- **Disable the plugin** if you do not use the device flow: remove `deviceAuthorization()` from your `plugins` array.\n- **Add a `before` hook** on `POST /device/approve` and `POST /device/deny` that tracks which session called `GET /device` for each user code, and rejects calls from a different session.\n- **Shorten the pending lifetime of device codes** via the `expiresIn` plugin option to reduce the exploitation window.\n\n### Impact\n\n- **Account takeover on the polling device**: the attacker\u0027s session becomes the device\u0027s session, so the device operates as the attacker.\n- **Denial of the legitimate sign-in**: the attacker can mark the code as denied, blocking the victim\u0027s flow.\n\n### Credit\n\nReported by Quikturn Security Team.\n\n### References\n\n- [CWE-285: Improper Authorization](https://cwe.mitre.org/data/definitions/285.html)\n- [CWE-863: Incorrect Authorization](https://cwe.mitre.org/data/definitions/863.html)\n- [CWE-639: Authorization Bypass Through User-Controlled Key](https://cwe.mitre.org/data/definitions/639.html)\n- [RFC 8628 \u00a75.5: Session Spying](https://datatracker.ietf.org/doc/html/rfc8628#section-5.5)",
  "id": "GHSA-cq3f-vc6p-68fh",
  "modified": "2026-06-09T11:58:19Z",
  "published": "2026-06-04T14:55:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-cq3f-vc6p-68fh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/pull/9573"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/better-auth/better-auth"
    },
    {
      "type": "WEB",
      "url": "https://github.com/better-auth/better-auth/releases/tag/v1.6.11"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-45337 (GCVE-0-2026-45337)

FKIE_CVE-2026-45337

GHSA-CQ3F-VC6P-68FH

Am I affected?

Summary

Details

Patches

Workarounds

Impact

Credit

References

Tags

Sightings

Nomenclature