@better-auth/expoに乗っ取り脆弱性、修正版あり
Summary
@better-auth/expoに、認証なしでアカウントの乗っ取りにつながる脆弱性が公表されました。ExpoアプリでBetter Authを使う組織は1.7.16へ更新し、そのあとアプリケーションシークレットも入れ替えてください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
@better-auth/expoに、認証なしでアカウントの乗っ取りにつながる脆弱性が公表されました。ExpoアプリでBetter Authを使う組織は1.7.16へ更新し、そのあとアプリケーションシークレットも入れ替えてください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| better-auth | better-auth |
< 1.7.16 |
1.7.16 |
| better-auth | Better Auth |
< 1.7.16 |
1.7.16 |
Original description The description as published by the source.
@better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixed version.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- web github.com
- web github.com
- web github.com