Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

better-auth/expo lets anyone change any account email

CVE-2026-121802 · published 3 days ago
Summary

The better-auth/expo component allows a malicious user to change the email address on any user account without logging in. This happens because it trusts a value supplied by the caller without confirming it came from the server. Update to version 1.7.16 or later and then rotate the application secret to secure your system.

What to do
  • Update better-auth better auth to version 1.7.16 or later.
Affected software
VendorProductAffected versions
better-auth better auth < 1.7.16
Original advisory text
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without check...
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-346Origin Validation Error
Timeline
Published4 Nov 2026
Updated7 Nov 2026
First seen4 Nov 2026
Sources
CVE-2026-121802 · NVD
CVE-2026-121802 · MITRE
Track software like this
Free during beta