better-auth 1.3.8-beta.3 through 1.7.0‑rc.3 suffers from a UI misrepresentation flaw in the deviceAuthorization plugin, where the GET /device endpoint fails to display the requesting client_id and scope. This omission lets an attacker initiate a device request, trick a logged‑in user into approving the request, and then redeem the code to receive a live session token. The vulnerability enables an attacker to impersonate users and gain unauthorized access, consistent with CWE‑451.

All deployments of better-auth versions 1.3.8‑beta.3 up to and including 1.6.x, and any build before 1.7.0‑rc.3, are impacted. The product affected is better-auth’s deviceAuthorization feature, operated via the /device, /device/code, and /device/token endpoints.

The vulnerability carries a CVSS score of 8.5, indicating a high severity. EPSS data is unavailable, and the issue is not currently listed in CISA’s KEV catalog, though the potential for phishing attacks remains significant. The attack vector requires user interaction: an attacker must convince a legitimate user to approve a seemingly legitimate device request and then redeem the code. Because the attacker ultimately obtains a session token, the risk to confidentiality, integrity, and availability of user accounts is high if the flaw is exploited.