Threats affecting pkg:npm/Better Auth

CVE-2026-121802 is a critical vulnerability in better-auth's Better Auth package versions before 1.7.16. It involves an origin validation error (CWE-346) where the software signs a caller-supplied state value without verifying if it was issued by the server. This flaw allows unauthenticated attackers to perform account takeover actions, such as changing any account's email address. The issue is fixed in version 1.7.16. After updating, the application secret must be rotated to ensure security.