CVE-2026-45337

Analyzed Analyzed - Analysis Complete

Authentication Bypass in Better Auth Device Authorization

Publication date: 2026-07-15

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker's account or deny the legitimate flow. This issue is fixed in version 1.6.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-21

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-45337

EUVD

EUVD-2026-44743

Affected Vendors & Products

Vendor	Product	Version / Range
better-auth	better_auth	From 1.6.0 (inc) to 1.6.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-45337 is a vulnerability in the Better Auth library affecting versions 1.6.0 to 1.6.10. The deviceAuthorization plugin did not properly bind device codes to the user who initiated the authorization flow. An authenticated attacker who observed a valid user code could either bind the polling device to their own account or deny the legitimate user's flow by exploiting this flaw.

Detection Guidance

To detect this vulnerability, check if your Better Auth library version is between 1.6.0 and 1.6.10. Inspect network logs for unauthorized GET /device, POST /device/approve, or POST /device/deny requests. Look for sessions approving or denying device codes they did not originate from.

Impact Analysis

This vulnerability allows an authenticated attacker to take over a user's session by manipulating device authorization requests. It could lead to unauthorized access to the victim's account, denial of legitimate access, or account takeover. The impact includes compromised confidentiality and integrity of user data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may also result in denial of access for legitimate users, potentially breaching availability requirements. Organizations using affected versions may face compliance violations and increased risk of data breaches.

Mitigation Strategies

Upgrade to Better Auth version 1.6.11 or later to apply the security fix.
If upgrading is not possible, disable the deviceAuthorization plugin temporarily.
Implement a before hook to track session ownership for device codes.
Shorten the device code lifetime to reduce the attack window.

Hi! I’m here to help you understand CVE-2026-45337. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70