Threats affecting pkg:npm/@better-auth/expo

@better-auth/expo versions before 1.7.16 contain a vulnerability that allows unauthenticated attackers to perform account takeover actions, such as changing any account's email address. This occurs because the library signs a caller-supplied state value without verifying that the value was issued by the server. After updating to a fixed version, it is necessary to rotate the application secret to fully mitigate the risk.