Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bind the polling device to the attacker's account or deny the legitimate flow. This issue is fixed in version 1.6.11.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:LBetter Auth
APPBetter-Auth1.6.0 – 1.6.11 (excl.)
Related vulnerabilities
Better Auth: pominięcie weryfikacji client_secret w endpointach OAuth token
SSRF w Better Auth — niezweryfikowane endpointy OIDC w pluginie SSO
Race condition w Better Auth umożliwia wielokrotne użycie kodu autoryzacyjnego OAuth2
Better Auth: Auth Bypass przez nieprawidłowe wiązanie konta OAuth
Race condition w Better Auth — wielokrotne użycie refresh token