CVE-2026-121802

Summary

In @better-auth/expo before 1.7.16, the server signs a caller-supplied state parameter without verifying it originated from the server, enabling attackers to forge valid state tokens and perform account-takeover attacks such as unauthorized email changes.

Exploitability

Exploitation is straightforward for remote attackers with network access, requiring only the ability to craft and submit a forged state value; no authentication or user interaction is needed.

Blast radius

Successful exploitation allows full account takeover of any user, including credential reset and data exposure, but does not affect system availability.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade @better-auth/expo to version 1.7.16 or later, and rotate the application secret immediately after upgrading as specified in the vendor advisory.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.