GHSA-cq3f-vc6p-68fh
High · 7.6CVSS
7.6
EPSS
—
Published
Jun 4, 2026
CISA due date
—
The record
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | better-auth | 1.6.0 | 1.6.11 |
Related vulnerabilities
- CVE-2026-45364 Better Auth is an authentication and authorization library for TypeScript. Also affects better-auth
- GHSA-p6v2-xcpg-h6xw Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix… Also affects better-auth
- GHSA-wxw3-q3m9-c3jr Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage… Also affects better-auth
- GHSA-xg6x-h9c9-2m83 Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching… Also affects better-auth
- GHSA-x732-6j76-qmhm Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass… Also affects better-auth
- GHSA-569q-mpph-wgww Better Auth affected by external request basePath modification DoS Also affects better-auth
- GHSA-wmjr-v86c-m9jj Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary… Also affects better-auth
- CVE-2025-61928 Better Auth is an authentication and authorization library for TypeScript. Also affects better-auth