{"id":"CVE-2026-121802","published":"2026-11-04T03:17:15.730","lastModified":"2026-11-04T03:17:15.877","description":"@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-346"],"vendors":[],"products":[],"references":[{"url":"https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md","tags":[]},{"url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.16","tags":[]},{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg","tags":[]}],"exploitRefs":[{"url":"https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md","tags":[]},{"url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.16","tags":[]},{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg","tags":[]}],"hasPoc":true,"ai":{"summary":"In @better-auth/expo before 1.7.16, the server signs a caller-supplied state parameter without verifying it originated from the server, enabling attackers to forge valid state tokens and perform account-takeover attacks such as unauthorized email changes.","exploitability":"Exploitation is straightforward for remote attackers with network access, requiring only the ability to craft and submit a forged state value; no authentication or user interaction is needed.","blast_radius":"Successful exploitation allows full account takeover of any user, including credential reset and data exposure, but does not affect system availability.","remediation":"Upgrade @better-auth/expo to version 1.7.16 or later, and rotate the application secret immediately after upgrading as specified in the vendor advisory.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["account-takeover","state-forgery","auth-bypass","oauth"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:55:43.169Z"}}