--- id: "TECH-202611-l23m74" kind: "technique" aliases: [] title: "Better Auth Expo plugin flaw lets anyone take over an account knowing only the victim's email (GHSA-4wq4-2ppv-q3hg, fixed in 1.7.16)" severity: "critical" cvss: null epss: null exploited: false status: "open" category: "package" products: [{"name": "@better-auth/expo", "fixed": ["1.7.16", "1.8.0-beta.5"], "affected": "< 1.7.16 (first affected version unknown); 1.8.0 beta < 1.8.0-beta.5", "ecosystem": "npm"}, {"name": "better-auth", "fixed": ["1.7.16", "1.8.0-beta.5"], "affected": "< 1.7.16; 1.8.0 beta < 1.8.0-beta.5", "ecosystem": "npm"}] ecosystems: [] tags: ["early-warning", "technique"] not_affected_if: [] published_at: "2026-11-03T00:00:00+00:00" first_seen_at: "2026-11-04T03:40:51+00:00" updated_at: "2026-11-04T03:42:53+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-04T03:40:51+00:00"}] --- # Better Auth Expo plugin flaw lets anyone take over an account knowing only the victim's email (GHSA-4wq4-2ppv-q3hg, fixed in 1.7.16) Better Auth's 3 Nov 2026 security release (v1.7.16 and v1.8.0-beta.5) fixes 12 advisories. The only critical one is in the server-side @better-auth/expo plugin (GHSA-4wq4-2ppv-q3hg, 'Authorization proxy can sign values it did not issue'). Its public, unauthenticated /expo-authorization-proxy endpoint signs whatever OAuth 'state' value the caller supplies with the app secret and returns the signature in the Set-Cookie header. The same secret signs HS256 email-verification JWTs and the 'compact' session cookie cache, so an attacker can forge a token that changes a victim's email to their own and get a session, knowing only the victim's email. No password, inbox access or victim action is needed. With the compact cookie cache, they can also forge a session outright, even with email verification off. The 'jwe' cache strategy is not forgeable this way. Strix found it and published a write-up with working reproduction output; Better Auth found it independently too. No exploitation in the wild has been reported. The other fixes include high-severity issues in Electron sign-in (can return the server secret and skip 2FA) and phone numbers being claimable before verification. Better Auth says apps deployed on Vercel got WAF protections, but it still says to upgrade. The first affected version of the Expo plugin is not given in the sources. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - npm:@better-auth/expo affected < 1.7.16 (first affected version unknown); 1.8.0 beta < 1.8.0-beta.5 fixed 1.7.16, 1.8.0-beta.5 - npm:better-auth affected < 1.7.16; 1.8.0 beta < 1.8.0-beta.5 fixed 1.7.16, 1.8.0-beta.5 ## How to check Check whether your backend uses better-auth with the server-side @better-auth/expo plugin (expo() in the plugins list), version below 1.7.16, or a 1.8.0 beta below 1.8.0-beta.5 (npm ls better-auth @better-auth/expo). If you do, look in your logs for requests to /expo-authorization-proxy from outside your mobile app followed by a /verify-email call, unexpected email changes on accounts, and sessions for users who did not sign in. Also check the other @better-auth/* packages you use (electron, passkey, stripe, kysely-adapter, phone number, admin, organization, email OTP plugins) against the 12 advisories. ## Fix Upgrade better-auth and every @better-auth/* package together to 1.7.16, or to 1.8.0-beta.5 on the beta line. Read the advisories for the plugins you use, because some fixes need a config step such as listing trusted origins. If you can't upgrade right away, block /expo-authorization-proxy at your proxy or WAF. After upgrading, review recent account email changes and consider rotating the Better Auth secret, which invalidates any forged tokens and sessions. ## Timeline - 2026-11-04T03:40:51+00:00 analyst ## Documents - [describes] @shcallaway: ATO in @better_auth 😑 https://t.co/Kh7mRrTBpM https://x.com/shcallaway/status/2117818307072172224 - [describes] Account takeover in @better-auth/expo - Strix https://www.strix.ai/blog/better-auth-expo-signing-oracle - [describes] Better Auth security release on Tuesday, November 3, 2026 https://better-auth.com/blog/security-release-2026-11-03 --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_