CVE-2026-121802: Critical severity vulnerability
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@better-auth/expoto a version that resolves this vulnerability.Fixed in 1.7.16 - Operational
Rotate the application secret after updating to the fixed version
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using @better-auth/expo versions before 1.7.16 are affected. The issue can enable account-takeover outcomes, including unauthenticated changes to another account's email address.
Does an attacker need an account or user interaction to exploit this?
No. The provided severity vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.
What must be done after upgrading?
Update to version 1.7.16 or later and rotate the application secret. Secret rotation is specifically required after updating to a fixed version.