CVE ID :CVE-2026-109346 Published : Oct. 12, 2026, 5:17 p.m. | 14 minutes ago Description :better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers...

#Sicherheitslücke #Phishing

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-109346 - better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device

VERWANDTEARTIKEL

CVE-2026-8451

CVE-2026-87744 - Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations

CVE-2026-57143 - PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

CVE-2026-59976 - ConvertX: Path Traversal vulnerability leading to Arbitrary File Write

CVE-2026-59977 - ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction

CVE-2026-65954 - PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()