CVE-2026-121802criticalCWE-346

CVE-2026-121802: falha crítica em better-auth Better Auth

Publicada em 04 nov 2026

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.2%

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Produtos afetados

better-auth · Better Auth

Referências

https://github.com/better-auth/better-auth/blob/main/packages/expo/CHANGELOG.md https://github.com/better-auth/better-auth/releases/tag/v1.7.16 https://github.com/better-auth/better-auth/security/advisories/GHSA-4wq4-2ppv-q3hg