{"id":"CVE-2026-121802","title":"@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued b…","summary":"@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued b…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-346"],"vendor":"better-auth","product":"Better Auth","affected":["better_auth < 1.7.16"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-11-06T18:45:29.653059Z"},"published":"2026-11-04","updated":"2026-11-06","sourceUpdated":"2026-11-06T18:45:40.015Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121802","references":[{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg"},{"url":"https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md"},{"url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.16"}],"tags":["cve.org"],"epss":0.00203,"epssPercentile":0.10351,"ingestedAt":"2026-11-05T20:33:06.662Z","slug":"CVE-2026-121802","body":"## Overview\n\n@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.\n\n## Affected\n\n- `better_auth < 1.7.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}