Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802)

Better Auth, a popular TypeScript authentication library, published a critical advisory on Nov 3 2026 for its expo() server plugin. The plugin's public /expo-authorization-proxy endpoint signed a caller-supplied state value with the application secret without checking that the server had issued it. Because Better Auth uses the same secret for email verification links and the session cookie cache, an unauthenticated attacker who knows a user's email address can sign in as that user and change the account's email, and with the cookie cache enabled, an attacker who knows a user ID can act as that user. The same endpoint was also an open redirect, and wildcard trustedOrigins entries could match URLs outside the intended scheme, host or path. You are affected if your server registers expo() from @better-auth/expo 1.4.0-beta.6 or later. Upgrade both @better-auth/expo and better-auth to 1.7.16 (or 1.8.0-beta.5), then rotate the application secret, because signatures issued before the fix stay valid until it changes.

Why this severity: CVSS 3.1 critical (AV:N/AC:L/PR:N/UI:N); unauthenticated account takeover on servers using the expo() plugin; no known exploitation

Started

Nov 3, 2026

CVE

CVE-2026-121802

• Node.js
• npm
• #Better Auth
• #Expo
• #Account Takeover
• #Auth