CVE-2026-121802

Name of the Vulnerable Software and Affected Versions @better-auth/expo versions prior to 1.7.16

Description An issue in the Expo plugin allows a remote, unauthenticated attacker to perform account takeovers, such as changing the email address of any account. This occurs because the system signs a caller-supplied state value without verifying if the value was originally issued by the server.

Recommendations Update to version 1.7.16. Rotate the application secret after updating to the fixed version.