---
id: CVE-2026-121802
title: >-
  @better-auth/expo before 1.7.16 allows certain account-takeover outcomes
  (e.g., unauthenticated changes of any account's email address), because it
  signs a caller-supplied state value without checking whether that value had
  been issued b…
summary: >-
  @better-auth/expo before 1.7.16 allows certain account-takeover outcomes
  (e.g., unauthenticated changes of any account's email address), because it
  signs a caller-supplied state value without checking whether that value had
  been issued b…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-346
vendor: better-auth
product: Better Auth
affected:
  - better_auth < 1.7.16
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-06T18:45:29.653059Z'
published: '2026-11-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:45:40.015Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121802'
references:
  - url: >-
      https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg
  - url: >-
      https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md
  - url: 'https://github.com/better-auth/better-auth/releases/tag/v1.7.16'
tags:
  - cve.org
epss: 0.00203
epssPercentile: 0.10351
ingestedAt: '2026-11-05T20:33:06.662Z'
---

## Overview

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.

## Affected

- `better_auth < 1.7.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.