{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802) · updates",
  "home_page_url": "https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802",
  "feed_url": "https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802/feed.json",
  "description": "Better Auth, a popular TypeScript authentication library, published a critical advisory on Nov 3 2026 for its expo() server plugin. The plugin's public /expo-authorization-proxy endpoint signed a caller-supplied state value with the application secret without checking that the server had issued it. Because Better Auth uses the same secret for email verification links and the session cookie cache, an unauthenticated attacker who knows a user's email address can sign in as that user and change the account's email, and with the cookie cache enabled, an attacker who knows a user ID can act as that user. The same endpoint was also an open redirect, and wildcard trustedOrigins entries could match URLs outside the intended scheme, host or path. You are affected if your server registers expo() from @better-auth/expo 1.4.0-beta.6 or later. Upgrade both @better-auth/expo and better-auth to 1.7.16 (or 1.8.0-beta.5), then rotate the application secret, because signatures issued before the fix stay valid until it changes.",
  "language": "en",
  "_pwn": {
    "slug": "better-auth-expo-account-takeover-cve-2026-121802",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802/feed.xml",
    "llms": "https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802/llms.txt",
    "json": "https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802#2026-11-04-183edc6a",
      "url": "https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802#2026-11-04-183edc6a",
      "title": "Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802): CVE-2026-121802 is published and GitHub's advisory database lists it as critical (CVSS 9.1).",
      "content_text": "Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802): CVE-2026-121802 is published and GitHub's advisory database lists it as critical (CVSS 9.1).\n\nSource: https://github.com/advisories/GHSA-hv45-wgqh-c9j5",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://github.com/advisories/GHSA-hv45-wgqh-c9j5",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802#2026-11-03-725a638d",
      "url": "https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802#2026-11-03-725a638d",
      "title": "Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802): Better Auth publishes GHSA-4wq4-2ppv-q3hg and releases 1.7.16 and 1.8.0-beta.5, fixing the Expo authorization proxy signing, an open redirect and loose wildcard trusted-origin matching; it tells users to rotate the application secret after upgrading.",
      "content_text": "Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802): Better Auth publishes GHSA-4wq4-2ppv-q3hg and releases 1.7.16 and 1.8.0-beta.5, fixing the Expo authorization proxy signing, an open redirect and loose wildcard trusted-origin matching; it tells users to rotate the application secret after upgrading.\n\nSource: https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg",
      "tags": [
        "critical"
      ]
    }
  ]
}