CVE-2026-121802: Account Takeover in the better-auth Expo Plugin
CVE-2026-121802 affects @better-auth/expo before version 1.7.16. The package signs a caller-supplied state value without checking whether that value had actually been issued by the server. An attacker can therefore get the server to vouch for a value it never created, which leads to account-takeover outcomes. The NVD example given is unauthenticated changes of any account's email address.
The entry is scored at CVSS 9.1 (Critical).
Key Facts
| Field | Detail |
|---|---|
| CVE | CVE-2026-121802 |
| Severity | Critical (CVSS 9.1) |
| Package | @better-auth/expo |
| Affected | Versions before 1.7.16 |
| Fixed in | 1.7.16 |
| Impact | Account takeover, including unauthenticated email changes |
| Published | 2026-11-04 |
Why It Matters
Mobile apps built with Expo and better-auth rely on signed state to bind an authentication flow to a request the server started. If the server signs any state a client supplies, that binding stops meaning anything. Email change is a common stepping stone to full takeover through password reset, so every account in an affected deployment should be treated as exposed.
Remediation
- Upgrade
@better-auth/expoto 1.7.16 or later and redeploy. - Rotate the application secret after upgrading. The advisory notes this is required, because state values signed with the old secret remain a risk if the secret is not changed.
- Audit account email changes made since you adopted an affected version, and look for accounts whose email changed without a matching user-initiated request.
- Invalidate active sessions for any account you cannot verify.
- Notify affected users if you find signs of abuse.