Security Resilience

CVE-2026-109346

Public PoC
Published
12 October 2026
Modified
12 October 2026
CVSS Score v4 8.5
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0028 19th percentile
Risk Priority 55 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-109346 is a high-severity User Interface (UI) Misrepresentation of Critical Information (CWE-451) vulnerability. Its CVSS base score is 8.5 (High).

Operationally, ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem…

more

it at /device/token for a live session token.

CWE(s)
CWE-451

Related Threats

CVEs Like This One

CVE-2026-17958Shared CWE-451
CVE-2026-0094Shared CWE-451
CVE-2026-106317Shared CWE-451
CVE-2026-10984Shared CWE-451
CVE-2026-14013Shared CWE-451
CVE-2024-0805Shared CWE-451
CVE-2026-11232Shared CWE-451
CVE-2025-29825Shared CWE-451
CVE-2026-13981Shared CWE-451
CVE-2026-3937Shared CWE-451

Affected Assets

Mitigating Controls

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.6.3 Information security awareness, education and training partial match
blocks

A.6.3 is awareness/education/training that informs people of their responsibilities and improves skills; it does not stop a UI misrepresentation weakness from remaining present or from being exploitable (e.g. in phishing).

A.8.23 Web filtering partial match
degrades

Web filtering can block known phishing sites that exploit UI misrepresentation.

A.8.25 Secure development life cycle partial match
blocks

Secure development lifecycle includes UI/UX security requirements that can prevent misrepresentation of critical information.

A.8.26 Application security requirements partial match
blocks

A.8.26 only requires that security requirements (including some that could indirectly relate to UI trustworthiness) be identified and specified during development; it does not itself enforce, implement, or stop UI misrepresentation from being exploitable.

A.8.28 Secure coding partial match
prevents

Secure coding practices can prevent UI flaws that obscure or spoof critical information.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect UI misrepresentation vulnerabilities before deployment.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-451, a class-level weakness, and none of its children carries one either.

References