Better Auth
Security incidents tagged Better Auth. Newest first.
1 Better Auth incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 1
- Longest quiet run: 0 days
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
Better Auth's Expo plugin let unauthenticated attackers take over accounts (CVE-2026-121802)
Better Auth, a popular TypeScript authentication library, published a critical advisory on Nov 3 2026 for its expo() server plugin. The plugin's public /expo-authorization-proxy endpoint signed a caller-supplied state value with the application secret without checking that the server had issued it. Because Better Auth uses the same secret for email verification links and the session cookie cache, an unauthenticated attacker who knows a user's email address can sign in as that user and change the account's email, and with the cookie cache enabled, an attacker who knows a user ID can act as that user. The same endpoint was also an open redirect, and wildcard trustedOrigins entries could match URLs outside the intended scheme, host or path. You are affected if your server registers expo() from @better-auth/expo 1.4.0-beta.6 or later. Upgrade both @better-auth/expo and better-auth to 1.7.16 (or 1.8.0-beta.5), then rotate the application secret, because signatures issued before the fix stay valid until it changes.
Better Auth (@better-auth/expo, better-auth on npm)Since Nov 3, 2026
