Better Auth Expo Plugin Account Takeover Vulnerability

The @better-auth/expo package before version 1.7.16 contains an account-takeover vulnerability because it signs a caller-supplied state value without checking whether that value was issued by the server.

This can result in serious impacts, including:

• Unauthenticated changes of any account's email address
• Other account-takeover outcomes

After updating to a fixed version, the application secret must be rotated.