Account Takeover Vulnerability in Better Auth Expo Product by Better Auth
CVE-2026-121802

9.1CRITICAL

Key Information:

Vendor

Better-auth

Status
Better Auth
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121802?

The Better Auth Expo product prior to version 1.7.16 is susceptible to account takeover risks due to improper validation of caller-supplied values when signing state information. An attacker could exploit this vulnerability to change an account's email address without proper authentication. After updating to a secure version, it is critical that users rotate their application secret to mitigate further risks.

Affected Version(s)

Better Auth 0 < 1.7.16

References

https://github.com/better-auth/better-auth/security/advis...
https://github.com/better-auth/better-auth/blob/main/pack...
https://github.com/better-auth/better-auth/releases/tag/v...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.