CVE-2026-45337 Details

A vulnerability exists in the Better Auth authentication and authorization library for TypeScript, specifically in versions 1.6.0 prior to 1.6.11. The issue arises within the device authorization plugin, which fails to properly bind ownership of pending device codes to the correct user session. This flaw allows an authenticated attacker to exploit the authorization process by using a valid user code to manipulate device polling actions, either by approving the code for their own account or denying it for the rightful user. The vulnerability stems from the 'GET /device' verification step not claiming ownership of the device code, leaving it open for interception. The problem is exacerbated by the 'POST /device/approve' and 'POST /device/deny' endpoints bypassing ownership checks when the userId is unset, creating a window of opportunity for exploitation.

Users can upgrade to Better Auth version 1.6.11 or later, where this vulnerability is fixed. If an immediate upgrade is not possible, the device authorization plugin can be disabled or a before hook can be added to the approval and denial endpoints to track and enforce session ownership.