---
id: "CVE-2026-121802"
kind: "vulnerability"
aliases: ["CVE-2026-121802"]
title: "better-auth Expo plugin: forged login state enables account takeover"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["better-auth", "expo", "npm", "package", "react-native"]
not_affected_if: ["package-not-installed"]
published_at: "2026-11-04T03:17:15+00:00"
first_seen_at: "2026-11-04T03:46:40+00:00"
updated_at: "2026-11-04T03:47:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121802", "first_seen_at": "2026-11-04T03:46:40+00:00"}]
---

# better-auth Expo plugin: forged login state enables account takeover

The @better-auth/expo package signs a state value supplied by the caller without checking that the server issued it. An unauthenticated attacker can use this to change any account's email address and take over the account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls @better-auth/expo`
- Look for `@better-auth/expo` in `package.json` and the lockfile
- Versions below `1.7.16` are affected

## Fix

- `@better-auth/expo` `1.7.16`
- Rotate the application secret after updating, as the advisory notes

## Timeline

- 2026-11-04T03:46:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121802

## Documents

- [advisory] Vendor advisory: github.com https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg
- [fix] Release notes: github.com https://github.com/better-auth/better-auth/releases/tag/v1.7.16

## From the sources

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_