Live › vulnerability › CVE-2026-121802
The @better-auth/expo package signs a state value supplied by the caller without checking that the server issued it. An unauthenticated attacker can use this to change any account's email address and take over the account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 03:46 UTC. All times on this page are UTC.
Applications that use the @better-auth/expo package in an Expo or React Native app with the better-auth authentication flow. Apps that do not depend on this package are not affected. Rotating the application secret is required after upgrading.
No product ranges from the sources yet.
npm ls @better-auth/expo@better-auth/expo in package.json and the lockfile1.7.16 are affected@better-auth/expo 1.7.16Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.
This page as .md · .json · in your agent: get_signal("CVE-2026-121802")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.