CVE-2026-121802

Unauthenticated account takeover in @better-auth/expo before 1.7.16

CVSS 3.1: 9.1 critical
EPSS: —
Published: Nov 4, 2026 · 1h ago
Modified: Nov 4, 2026

Analyze CVE-2026-121802 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

@better-auth/expo before 1.7.16 signs a caller-supplied state value without verifying it was server-issued, enabling unauthenticated changes to any account's email address. Attackers trigger this over the network with no authentication. They gain account takeover. Users of affected versions are impacted.

What to do: Upgrade @better-auth/expo to 1.7.16 and rotate the application secret.

Product	Affected	Fixed in
better-auth expo	before 1.7.16	1.7.16

Estimated exposure

No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.

Weakness: CWE-346

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (—)

In the news

0 stories

No ingested article mentions this CVE yet.