Better Auth Expo plugin flaw lets anyone take over an account knowing only the victim's email (GHSA-4wq4-2ppv-q3hg, fixed in 1.7.16)

Better Auth's 3 Nov 2026 security release (v1.7.16 and v1.8.0-beta.5) fixes 12 advisories. The only critical one is in the server-side @better-auth/expo plugin (GHSA-4wq4-2ppv-q3hg, 'Authorization proxy can sign values it did not issue'). Its public, unauthenticated /expo-authorization-proxy endpoint signs whatever OAuth 'state' value the caller supplies with the app secret and returns the signature in the Set-Cookie header. The same secret signs HS256 email-verification JWTs and the 'compact' session cookie cache, so an attacker can forge a token that changes a victim's email to their own and get a session, knowing only the victim's email. No password, inbox access or victim action is needed. With the compact cookie cache, they can also forge a session outright, even with email verification off. The 'jwe' cache strategy is not forgeable this way. Strix found it and published a write-up with working reproduction output; Better Auth found it independently too. No exploitation in the wild has been reported. The other fixes include high-severity issues in Electron sign-in (can return the server secret and skip 2FA) and phone numbers being claimable before verification. Better Auth says apps deployed on Vercel got WAF protections, but it still says to upgrade. The first affected version of the Expo plugin is not given in the sources.

Summary written from the sources below. Check the originals before acting.