{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-109346/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:better-auth:better-auth:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-109346"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["better-auth (1.3.8-beta.3 to \u003c 1.7.0-rc.3)"],"_cs_severities":["high"],"_cs_tags":["web-application-security","authentication-bypass","cve-2026-109346"],"_cs_type":"advisory","_cs_vendors":["better-auth"],"content_html":"\u003cp\u003eThe better-auth library, specifically versions 1.3.8-beta.3 through 1.6.x (prior to 1.7.0-rc.3), contains a UI misrepresentation vulnerability within its deviceAuthorization plugin. This flaw stems from the plugin's failure to include the requesting client_id and scope when rendering the device authorization prompt to the user. Consequently, a user is presented with an ambiguous request that lacks the context necessary to verify the legitimacy of the authorization attempt. An attacker can exploit this lack of transparency by initiating a malicious device code flow and tricking an already signed-in user into granting authorization. Once the user approves the request, the attacker can leverage the authorized code to obtain a valid session token via the /device/token endpoint, leading to unauthorized account access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in unauthorized account access and potential session hijacking. Because the attack relies on misleading an authenticated user, it can bypass standard security expectations regarding authorization prompts. The scope of impact is limited to applications using the vulnerable deviceAuthorization plugin within the identified version range of better-auth.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the better-auth dependency to version 1.7.0-rc.3 or later to remediate CVE-2026-109346.\u003c/li\u003e\n\u003cli\u003eReview application logs for anomalous spikes in authorization requests to the /device/code endpoint that do not correlate with legitimate user-driven workflows.\u003c/li\u003e\n\u003cli\u003eAudit device authorization workflows to ensure all relevant metadata, including client identification and requested scopes, is explicitly displayed to users prior to approval.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T18:37:28Z","date_published":"2026-10-12T18:37:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-better-auth-ui-misrepresentation/","summary":"The better-auth library's deviceAuthorization plugin fails to display client_id and scope information, enabling attackers to deceive authenticated users into authorizing malicious device codes.","title":"UI Misrepresentation Vulnerability in better-auth Device Authorization","url":"https://feed.craftedsignal.io/briefs/2026-10-better-auth-ui-misrepresentation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-109346","version":"https://jsonfeed.org/version/1.1"}