CVE-2026-45337: Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending

Better Auth’s deviceAuthorization plugin treated any authenticated session as the owner of any pending device code. The ownership gate on POST /device/approve and POST /device/deny short-circuited whenever the row’s userId was unset, and the GET /device verification handler did not claim the row. An authenticated attacker who learned a valid user_code before the legitimate user completed approval could bind the polling device to the attacker’s account or deny the legitimate flow.