Product
The better-auth library's deviceAuthorization plugin fails to display client_id and scope information, enabling attackers to deceive authenticated users into authorizing malicious device codes.