{"id":"CVE-2026-121802","kind":"vulnerability","aliases":["CVE-2026-121802"],"related":[],"title":"better-auth Expo plugin: forged login state enables account takeover","description":"@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.","summary":"The @better-auth/expo package signs a state value supplied by the caller without checking that the server issued it. An unauthenticated attacker can use this to change any account's email address and take over the account.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["better-auth","expo","npm","package","react-native"],"not_affected_if":["package-not-installed"],"how_to_check":"- Check the installed version with `npm ls @better-auth/expo`\n- Look for `@better-auth/expo` in `package.json` and the lockfile\n- Versions below `1.7.16` are affected","fix":"- `@better-auth/expo` `1.7.16`\n- Rotate the application secret after updating, as the advisory notes","status":"open","published_at":"2026-11-04T03:17:15+00:00","first_seen_at":"2026-11-04T03:46:40+00:00","triaged_at":"2026-11-04T03:47:15+00:00","updated_at":"2026-11-04T03:47:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T03:47:15Z","model":"claude-haiku-5-5","output":{"fix":"- `@better-auth/expo` `1.7.16`\n- Rotate the application secret after updating, as the advisory notes","reach":"internet","title":"better-auth Expo plugin: forged login state enables account takeover","impact":"high","summary":"The @better-auth/expo package signs a state value supplied by the caller without checking that the server issued it. An unauthenticated attacker can use this to change any account's email address and take over the account.","audience":"developers","category":"package","nicknames":[],"who_cares":["better-auth","expo","react-native","npm"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker changes any account's email and takes it over","analyst_note":"Confirm the exact exploit preconditions and whether the Expo OAuth flow is the only exposed path; check the release notes and vendor advisory linked in the sources.","how_to_check":"- Check the installed version with `npm ls @better-auth/expo`\n- Look for `@better-auth/expo` in `package.json` and the lockfile\n- Versions below `1.7.16` are affected","plain_action":"","needs_analyst":true,"not_affected_if":["package-not-installed"],"who_is_affected":"Applications that use the @better-auth/expo package in an Expo or React Native app with the better-auth authentication flow. Apps that do not depend on this package are not affected. Rotating the application secret is required after upgrading.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00068,"input_tokens":4163,"output_tokens":527,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-121802':14A,17A '-2026':13A,16A '/expo':31B,69C '1.7.16':71C 'account':10A,57B,65B,75C,83C 'account-takeov':74C 'address':60B,86C 'allow':72C 'applic':109C 'attack':50B 'auth':3A,20B,30B,68C 'better':2A,19B,29B,67C 'better-auth':1A,18B,28B,66C 'caller':40B,92C 'caller-suppli':91C 'certain':73C 'chang':55B,80C 'check':42B,97C 'cve':12A,15A 'e.g':78C 'email':59B,85C 'enabl':9A 'expo':4A,21B 'fix':118C 'forg':6A 'issu':46B,103C 'login':7A 'must':111C 'nativ':26B 'note':107C 'npm':22B 'outcom':77C 'packag':23B,32B 'plugin':5A 'react':25B 'react-nat':24B 'rotat':113C 'secret':110C 'server':45B,106C 'sign':33B,89C 'state':8A,35B,94C 'suppli':37B,93C 'take':62B 'takeov':11A,76C 'unauthent':49B,79C 'updat':115C 'use':52B 'valu':36B,95C,100C 'version':119C 'whether':98C 'without':41B,96C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the @better-auth/expo package in an Expo or React Native app with the better-auth authentication flow. Apps that do not depend on this package are not affected. Rotating the application secret is required after upgrading.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["betterauth","critical","expo","npm","package","reactnative"],"campaign_type":null,"first_public_at":"2026-11-03T21:37:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121802","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121802","severity":null,"published_at":"2026-11-04T03:17:15+00:00","modified_at":"2026-11-04T03:17:15+00:00","first_seen_at":"2026-11-04T03:46:40+00:00","fetched_at":"2026-11-04T03:46:40+00:00","note":null}],"documents":[{"id":63803,"url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.16","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":63804,"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T21:37:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}