GHSA-4wq4-2ppv-q3hg: Critical severity vulnerability
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@better-auth/expoto a version that resolves this vulnerability.Fixed in 1.7.16 - Operational
Rotate the application secret after updating to the fixed version.
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using @better-auth/expo versions before 1.7.16 are affected. The issue is remotely exploitable and does not require prior authentication, privileges, or user interaction.
What can an attacker do?
An attacker may achieve account-takeover outcomes, including changing the email address of any account without authentication.
What should be done after upgrading?
Update to a fixed version, 1.7.16 or later, and rotate the application secret. Secret rotation is required after updating.
How can I determine whether my application needs remediation?
Check the installed @better-auth/expo version. Any version earlier than 1.7.16 requires an update and application-secret rotation.