Cve-2026-109346 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-109346/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 12 Oct 2026 18:37:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUI Misrepresentation Vulnerability in better-auth Device Authorizationhttps://feed.craftedsignal.io/briefs/2026-10-better-auth-ui-misrepresentation/Mon, 12 Oct 2026 18:37:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-better-auth-ui-misrepresentation/The better-auth library's deviceAuthorization plugin fails to display client_id and scope information, enabling attackers to deceive authenticated users into authorizing malicious device codes.The better-auth library, specifically versions 1.3.8-beta.3 through 1.6.x (prior to 1.7.0-rc.3), contains a UI misrepresentation vulnerability within its deviceAuthorization plugin. This flaw stems from the plugin's failure to include the requesting client_id and scope when rendering the device authorization prompt to the user. Consequently, a user is presented with an ambiguous request that lacks the context necessary to verify the legitimacy of the authorization attempt. An attacker can exploit this lack of transparency by initiating a malicious device code flow and tricking an already signed-in user into granting authorization. Once the user approves the request, the attacker can leverage the authorized code to obtain a valid session token via the /device/token endpoint, leading to unauthorized account access.

Impact

Successful exploitation results in unauthorized account access and potential session hijacking. Because the attack relies on misleading an authenticated user, it can bypass standard security expectations regarding authorization prompts. The scope of impact is limited to applications using the vulnerable deviceAuthorization plugin within the identified version range of better-auth.

Recommendation

  1. Upgrade the better-auth dependency to version 1.7.0-rc.3 or later to remediate CVE-2026-109346.
  2. Review application logs for anomalous spikes in authorization requests to the /device/code endpoint that do not correlate with legitimate user-driven workflows.
  3. Audit device authorization workflows to ensure all relevant metadata, including client identification and requested scopes, is explicitly displayed to users prior to approval.
]]>highadvisoryweb-application-securityauthentication-bypasscve-2026-109346