CVE-2026-121802

EUVD-2026-116694
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.38%
Common Weakness Enumeration
References
https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md
https://github.com/better-auth/better-auth/releases/tag/v1.7.16
https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg