Auth bypass in Better-auth
CVE-2026-45337
Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim…
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L.
Affected products
- Better-auth — versions >= 1.6.0, < 1.6.11
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-45337?
- CVE-2026-45337 is a high-severity vulnerability in Better-auth, classified under Improper Authorization. CVSS score: 7.6/10. Published 2026-07-15.
- How severe is CVE-2026-45337?
- High severity. CVSS v3 base score is 7.6 out of 10.