CVE-2026-121802

{
  "etk_id": "ETK-2026-3439",
  "cve_id": "CVE-2026-121802",
  "display_id": "CVE-2026-121802",
  "ghsa_id": "GHSA-4wq4-2ppv-q3hg",
  "euvd_id": "EUVD-2026-116694",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper state validation in better-auth Expo integration",
  "summary": "The Expo integration in better-auth versions before 1.7.16 does not verify that state values were issued by the server before signing them. An unauthenticated attacker may alter an account email address, which can lead to account takeover. Exposure requires use of the affected Expo authentication flow.",
  "mitigation": "Update better-auth to version 1.7.16 or later. Rotate the application secret after upgrading.",
  "vendor": "better-auth",
  "product": "better-auth",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.4.0-beta.6, < 1.7.16"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.7.16"
      ],
      "package_name": "@better-auth/expo",
      "purl": "pkg:npm/@better-auth/expo"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.8.0-beta.0, < 1.8.0-beta.5"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.8.0-beta.5"
      ],
      "package_name": "@better-auth/expo",
      "purl": "pkg:npm/@better-auth/expo"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.7.16"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.7.16"
      ],
      "package_name": "better-auth",
      "purl": "pkg:npm/better-auth"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.8.0-beta.0, < 1.8.0-beta.5"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.8.0-beta.5"
      ],
      "package_name": "better-auth",
      "purl": "pkg:npm/better-auth"
    }
  ],
  "cwes": [
    346
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.95546545,
  "t0_at": "2026-11-04T02:36:13.640000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T21:37:25+00:00",
      "days": -0.20750740740740742,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T02:36:13.640000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-121802"
    }
  }
}