CVE-2026-121802 PUBLISHED

Assigner: mitre
Reserved: 04.11.2026 Published: 04.11.2026 Updated: 04.11.2026

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 9.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	better-auth
Product	Better Auth
Versions	Default: unaffected affected from 0 to 1.7.16 (excl.)

References

https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg
https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md
https://github.com/better-auth/better-auth/releases/tag/v1.7.16

Problem Types

CWE-346 Origin Validation Error CWE