# Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802) · pwn.watch > Better Auth, a popular TypeScript authentication library, published a critical advisory on Nov 3 2026 for its expo() server plugin. The plugin's public /expo-authorization-proxy endpoint signed a caller-supplied state value with the application secret without checking that the server had issued it. Because Better Auth uses the same secret for email verification links and the session cookie cache, an unauthenticated attacker who knows a user's email address can sign in as that user and change the account's email, and with the cookie cache enabled, an attacker who knows a user ID can act as that user. The same endpoint was also an open redirect, and wildcard trustedOrigins entries could match URLs outside the intended scheme, host or path. You are affected if your server registers expo() from @better-auth/expo 1.4.0-beta.6 or later. Upgrade both @better-auth/expo and better-auth to 1.7.16 (or 1.8.0-beta.5), then rotate the application secret, because signatures issued before the fix stay valid until it changes. Page: https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802 · generated 2026-11-05T13:02:03.301Z ## Status - Severity: critical · status: live · patch: patched - Product: Better Auth (@better-auth/expo, better-auth on npm) - Started: 2026-11-03 - CVEs: CVE-2026-121802 - Affected: @better-auth/expo >= 1.4.0-beta.6, < 1.7.16; @better-auth/expo >= 1.8.0-beta.0, < 1.8.0-beta.5; better-auth < 1.7.16 and >= 1.8.0-beta.0, < 1.8.0-beta.5 - Fixed in: 1.7.16; 1.8.0-beta.5 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802/feed.xml - JSON Feed: https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802.json - This file: https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802/llms.txt ## Updates (newest first) - 2026-11-04: CVE-2026-121802 is published and GitHub's advisory database lists it as critical (CVSS 9.1). (https://github.com/advisories/GHSA-hv45-wgqh-c9j5) - 2026-11-03: Better Auth publishes GHSA-4wq4-2ppv-q3hg and releases 1.7.16 and 1.8.0-beta.5, fixing the Expo authorization proxy signing, an open redirect and loose wildcard trusted-origin matching; it tells users to rotate the application secret after upgrading. (https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg) ## Fix brief # Security brief: Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802) Source: https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802 · status: live · severity: critical · updated Nov 4, 2026, 09:34 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Better Auth, a popular TypeScript authentication library, published a critical advisory on Nov 3 2026 for its expo() server plugin. The plugin's public /expo-authorization-proxy endpoint signed a caller-supplied state value with the application secret without checking that the server had issued it. Because Better Auth uses the same secret for email verification links and the session cookie cache, an unauthenticated attacker who knows a user's email address can sign in as that user and change the account's email, and with the cookie cache enabled, an attacker who knows a user ID can act as that user. The same endpoint was also an open redirect, and wildcard trustedOrigins entries could match URLs outside the intended scheme, host or path. You are affected if your server registers expo() from @better-auth/expo 1.4.0-beta.6 or later. Upgrade both @better-auth/expo and better-auth to 1.7.16 (or 1.8.0-beta.5), then rotate the application secret, because signatures issued before the fix stay valid until it changes. Severity detail: CVSS 3.1 critical (AV:N/AC:L/PR:N/UI:N); unauthenticated account takeover on servers using the expo() plugin; no known exploitation - Product: Better Auth (@better-auth/expo, better-auth on npm) - CVE / advisory ids: CVE-2026-121802 ## Affected versions - @better-auth/expo >= 1.4.0-beta.6, < 1.7.16 - @better-auth/expo >= 1.8.0-beta.0, < 1.8.0-beta.5 - better-auth < 1.7.16 and >= 1.8.0-beta.0, < 1.8.0-beta.5 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 1.7.16 - 1.8.0-beta.5 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Check whether the auth server registers `expo()` from `@better-auth/expo`. If so, upgrade both `@better-auth/expo` and `better-auth` to 1.7.16 (or 1.8.0-beta.5 on the beta line), then rotate the Better Auth application secret (`BETTER_AUTH_SECRET`). If you do not use Expo social sign-in, removing the `expo()` server plugin is a workaround. If Expo SSO sign-in breaks after upgrading, add the identity provider's origin to `trustedOrigins`. ## Latest updates - Nov 4, 2026: CVE-2026-121802 is published and GitHub's advisory database lists it as critical (CVSS 9.1). - Nov 3, 2026: Better Auth publishes GHSA-4wq4-2ppv-q3hg and releases 1.7.16 and 1.8.0-beta.5, fixing the Expo authorization proxy signing, an open redirect and loose wildcard trusted-origin matching; it tells users to rotate the application secret after upgrading. ## Advisories - [@better-auth/expo: Authorization proxy can sign values it did not issue](https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg) (Better Auth (GitHub)) - [GHSA-hv45-wgqh-c9j5 (CVE-2026-121802)](https://github.com/advisories/GHSA-hv45-wgqh-c9j5) (GitHub Advisory Database) - [better-auth v1.7.16 release](https://github.com/better-auth/better-auth/releases/tag/v1.7.16) (Better Auth (GitHub)) --- Machine-readable: https://pwn.watch/i/better-auth-expo-account-takeover-cve-2026-121802.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.