CVE-2026-121802 Details
Description
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.
A vulnerability in the @better-auth/expo package, affecting versions 1.4.0-beta.6 prior to 1.7.16 and 1.8.0-beta.0 prior to 1.8.0-beta.5, allows for certain account takeover scenarios. The issue arises because the authorization proxy endpoint signs a caller-supplied state value with the application secret, without verifying if the state was issued by the server. This flaw can lead to unauthorized changes to a user's email address. Additionally, with the session cookie cache enabled, an attacker who knows a user's ID can impersonate that user.
Users should upgrade to @better-auth/expo and better-auth version 1.7.16, or to 1.8.0-beta.5 on the beta line. After upgrading, it is recommended to rotate the application secret if the endpoint was accessible. If Expo sign-in through an SSO identity provider fails after the upgrade, the identity provider's origin should be added to the trustedOrigins.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md | [email protected] | Release NotesVendor |
| https://github.com/better-auth/better-auth/releases/tag/v1.7.16 | [email protected] | Release NotesVendor |
| https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| better-auth/expo | >= 1.4.0-beta.6, < 1.7.16 (semver) >= 1.8.0-beta.0, < 1.8.0-beta.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | New CVE Received | [email protected] |