Better Auth Expo package lets attackers change account emails
Login tools in apps let strangers change account emails!
Summary
A flaw in how @better-auth/expo signs a caller-supplied state value lets an unauthenticated attacker change any account's email address. Versions before 1.7.16 are affected.
Affected when
- Uses the @better-auth/expo package
What to do
Update @better-auth/expo to 1.7.16 or later, then rotate the application secret.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen