# CVE-2026-121802: Better Auth

- Exploited (CISA KEV): no
- Published: 2026-11-04
- CVSS: 9.1 CRITICAL (v3.1)
- EPSS: no score
- CWE: CWE-346

@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| Vercel | Blocks by default | 2026-11-04 | 0 |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Vercel

- 2026-11-04 · new · default Block
  > Vercel created new rules to address these vulnerabilities and deployed them to the Vercel WAF to automatically protect all projects hosted on Vercel at no cost. Vercel deployed WAF rules that block the exploitable request patterns for the advisories that can be identified at the request layer, including the critical @better-auth/expo issue. Logic-level issues, such as session revocation with secondary storage, cannot be blocked by a WAF and are fixed only by upgrading.
  Source: https://vercel.com/kb/bulletin/better-auth-november-2026-security-release

## Social

10 posts seen since 2026-11-04.

- bluesky 2026-11-04: 🔴 CVE-2026-121802 - Critical (9.1)  @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated c...  https://www.thehackerwire.com/vulnerability/CVE-2026-121802/  #infosec #cybersecurity #CVE #vulnerability #security #patchstack (https://bsky.app/profile/thehackerwire.bsky.social/post/3mzhnqsmasc23)
- mastodon 2026-11-04: 🔴 CVE-2026-121802 - Critical (9.1) @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the… (https://mastodon.social/@thehackerwire/117556594746719941)
- bluesky 2026-11-04: CVE-2026-121802 - better auth The better-auth/expo component allows a malicious user to change the email address on any user account without logging in. This happens because it trusts a value supplied by the…  Too many irrelevant or confusing CVEs? Use stackflag.com  #betterauth… (https://bsky.app/profile/stackflag.bsky.social/post/3mzhispsqgp2z)
- x 2026-11-04: 🆕 New CVE: CVE-2026-121802 (CVSS 9.1) @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any… Remote, no login needed.  @better-auth/expo before 1.7.16 allows certain account-takeover outcomes…  https://t.co/Iwml2HXpFr (https://x.com/EnclaveRadar/status/2117833165674778706)
- bluesky 2026-11-04: 🚨 CVE-2026-121802 — CVSS 9.1 CRITICAL  @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of ...  🔎 https://stemshop.top/cve/CVE-2026-121802  #CVE #CyberSecurity #InfoSec (https://bsky.app/profile/stemshop.bsky.social/post/3mzhi5ugsb52n)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-121802 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-121802