# CVE-2026-121802: better-auth/expo signature validation bypass allowing account takeover

Source: https://junglewise.ai/threats/cve-2026-121802-better-auth-expo-before-1-7-16-allows-certain-account-takeover  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-121802 · Severity: critical · CVSS 9.1 · Published 2026-11-04

@better-auth/expo is an authentication library for mobile apps that handles user sign-in and account management. A critical vulnerability allows attackers to forge OAuth state values without authentication, enabling them to change any account's email address or take over accounts. This could grant an attacker full access to compromised user accounts and their associated data.

Vendors: [Better-Auth](https://junglewise.ai/threats/vendors/better-auth).

## Quick answers

**Is CVE-2026-121802 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121802 being exploited in the wild.

**How severe is CVE-2026-121802?** Critical severity, with a CVSS score of 9.1, published 4 November 2026.

**Which products and versions are affected?** Better-Auth Expo before 1.7.16.

**Is there a fix for CVE-2026-121802?** Yes: fixed in 1.7.16. Until then: After updating to version 1.7.16, the application secret must be rotated to invalidate all signatures created with the previous key. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121802 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121802?** Check whether you run Better-Auth Expo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.7.16

After updating to version 1.7.16, the application secret must be rotated to invalidate all signatures created with the previous key.

## Technical details

The authorization proxy in @better-auth/expo signs caller-supplied OAuth state values without validating that the server originally issued them, allowing attackers to forge state parameters. An attacker can exploit this over the network during OAuth flows to trigger account modifications such as email address changes without authentication. The fix requires both updating to version 1.7.16 and rotating the application secret to invalidate signatures created with the old key.

## Affected products

- better-auth expo before 1.7.16

## Timeline

- 2026-11-04: disclosed

## References

- [https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md](https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md)
- [https://github.com/better-auth/better-auth/releases/tag/v1.7.16](https://github.com/better-auth/better-auth/releases/tag/v1.7.16)