The Better Auth library’s deviceAuthorization plugin contains a flaw that lets a logged‑in user exploit any pending device code. GET /device does not reserve the pending row, while POST /device/approve and POST /device/deny skip ownership checks when the userId is unset. Consequently, any authenticated session can bind a valid user_code to the attacker’s own account or abort the legitimate authorization flow. The impact is unauthorized access or denial of service for legitimate users, stemming from missing authorization checks (CWE‑285) and inadequate identity verification during approval (CWE‑345).

Better Auth, a TypeScript authentication and authorization library, versions 1.6.0 through 1.6.11 are affected. The vulnerability is present in the deviceAuthorization plugin used by applications that implement OAuth2‑style device authorization flows.

The CVSS score of 7.6 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests exploitation is currently rare. The flaw is not listed in the CISA KEV catalog, but attackers can still exploit it remotely by accessing the /device, /device/approve, and /device/deny endpoints, provided they obtain a valid, pending user_code and have an authenticated session. Successful exploitation would allow the attacker to bind the code to their account or deny the legitimate flow, yielding unauthorized access or denial of service.