CVE-2026-121802
Critical
Description
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.
SeverityCritical
CVSS9.1
Exploit probability—
Product@better-auth Expo
PublishedNov 4, 2026
First seenNov 4, 2026
Weakness typeCWE-346CWE-346
How to fix
Update
- @better-auth expo1.7.16 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @better-auth expo | No range specified | 1.7.16 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.