{"affected":[{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"%40better-auth/expo","product":"Better Auth","source":"CNA: mitre","vendor":"better-auth","versions":[{"lessThan":"1.7.16","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-121802","cwes":["CWE-346"],"description":"@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.","epss":{"date":"2026-11-04","percentile":0.10383,"score":0.00203},"exploits":[],"kev":null,"metrics":[{"score":9.1,"severity":"critical","source":"CNA: mitre","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},{"score":9.1,"severity":"critical","source":"NVD: cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793762235877,"publishedAt":1793759773640,"references":[{"source":"CNA: mitre","tags":[],"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md"},{"source":"CNA: mitre","tags":[],"url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.16"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/better-auth/better-auth/releases/tag/v1.7.16"},{"source":"cve@mitre.org","tags":[],"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg"}],"remediation":[],"revision":"e268cc7c14f6300bae5d25c2c612546df2e541aacbce86f8bf7c7faaa25246b4","sources":[{"modifiedAt":1793760247935,"name":"CNA: mitre","retrievedAt":1793761737053,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121802"},{"modifiedAt":1793762235877,"name":"NVD","retrievedAt":1793773046088,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121802"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793858308907,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-121802"}],"ssvc":null,"status":"published","title":"CVE-2026-121802","updatedAt":1793858308907}