{"id":"ghsa-ghsa-q84f-53jg-9ppm","seq":1708818,"kind":"advisory","title":"better-auth: Device login approval does not show the requesting client or permissions","url":"https://github.com/advisories/GHSA-q84f-53jg-9ppm","permalink":"https://vulnpulse.app/items/ghsa-ghsa-q84f-53jg-9ppm","summary":"影響: npm:better-auth >= 1.3.8-beta.3, < 1.7.0-rc.3 → 1.7.0-rc.3\nAm I affected? You may be affected if you use better-auth from 1.3.8-beta.3 up to, but not including, 1.7.0-rc.3, and you enable the deviceAuthorization() plugin. This range includes all 1.6 releases. You are affected only if all of these are also true: - An attacker can start a device request: validateClient is not configured, or the attacker can use a valid public client. - Before allowing approval, your approval page does not show, from server-checked data, which client is asking and the exa…","severity":"high","techs":["nodejs"],"cves":[],"tags":["GHSA-q84f-53jg-9ppm","better-auth"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T14:49:53.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}