Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:better-Auth:better-Auth:*:*:*:*:*:*:*:*

1 brief RSS
high advisory

UI Misrepresentation Vulnerability in better-auth Device Authorization

The better-auth library's deviceAuthorization plugin fails to display client_id and scope information, enabling attackers to deceive authenticated users into authorizing malicious device codes.

better-auth web-application-security authentication-bypass cve-2026-109346
1t 1c