Better Auth Vulnerabilities Allow Account Takeover Through Expo and Electron Plugins
TL;DR
Better Auth published three security advisories on November 3, 2026, alongside version 1.7.16 of the TypeScript authentication library. The worst of these Better Auth vulnerabilities, rated CVSS 9.1, lets an unauthenticated attacker sign in as any user whose email address they know. The other two flaws affect phone sign-in and the Electron desktop plugin.
Apps that register the expo() plugin face a zero-click account takeover risk. A separate Electron plugin bug can leak the server’s auth secret to any signed-in user. Upgrade to better-auth 1.7.16 or 1.8.0-beta.5, then rotate your secrets.
Why It Matters
Better Auth is an open-source authentication library for TypeScript apps. Because all three bugs touch core identity checks, the impact is direct account takeover. According to the Expo advisory, the attack works “with no action from the user.”
So far, no exploitation in the wild and no public proof-of-concept have been reported.
How the Attacks Work
Expo plugin signs values it never issued (CVE-2026-121802, CVSS 9.1)
The expo() plugin adds a public endpoint that helps a browser start social sign-in. However, it “signed a value taken from the request with the application secret.” Better Auth uses that same secret for email verification links and the session cookie cache. As a result, an attacker could forge an email-change token and take over the account. The same endpoint also allowed an open redirect, and wildcard trusted origins could match unintended URLs.
Phone numbers claimed before verification (GHSA-q747-mqgr-4gh7, CVSS 8.1)
Sign-up flows could save a phone number before anyone proved ownership. An attacker could attach a victim’s number to their own account. Later, when the victim signs in with a valid code, the victim “gets a session for the attacker’s account.” Data the victim enters may then reach the attacker. Notably, the attacker does not get into the victim’s own account.
Electron plugin leaks the server secret (GHSA-9p5w-h4pr-fcrc, CVSS 8.1)
A normal sign-in could return the server’s internal auth context. That context “includes the auth secret and the client secrets of configured social providers.” With the secret, a user could forge a session as anyone whose email they know. In some plugin orders, a password sign-in could also skip two-factor checks.
Affected Versions
- @better-auth/expo: 1.4.0-beta.6 up to 1.7.16
- @better-auth/electron: 1.5.0-beta.12 up to 1.7.16
- better-auth phone number plugin: 0.4.12-beta.7 up to 1.7.16
- Beta line: 1.8.0-beta.0 up to 1.8.0-beta.5
Patch and Mitigation
- Upgrade better-auth, @better-auth/expo and @better-auth/electron to 1.7.16, or 1.8.0-beta.5.
- Rotate the application secret if the Expo endpoint was reachable. Old signatures “stay valid until the secret changes.”
- If the Electron plugin ran, rotate the auth secret and every social provider client secret.
- Clear phone numbers that were never verified, since 1.7.16 only blocks new ones.
- If you cannot upgrade, remove the expo() and electron() server plugins.
The project’s Better Auth security release post covers the full set of Better Auth vulnerabilities and upgrade steps.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
