Homepage

@better-auth/expo@1.8.0-beta.2

Better Auth integration for Expo and React Native applications.

  • latest version

    1.7.18

  • latest non vulnerable version

    1.8.0-beta.6

  • first published

    2 years ago

  • latest version published

    3 days ago

  • licenses detected

    • MIT
      >=1.3.0-beta.4
  • View expo package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @better-auth/expo package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Origin Validation Error

    Affected versions of this package are vulnerable to Origin Validation Error via the expo() plugin's public authorization-proxy endpoint, which signs a caller-supplied state value with the application secret without verifying that the server had previously issued that value. Because the same HMAC-SHA256 secret is used for email verification links and the session cookie cache, an attacker can forge an email-change token or a session cookie cache value that Better Auth accepts as legitimate. This allows an unauthenticated attacker who knows a target user's email address to take over the account and change its email address, and - when the session cookie cache is enabled - an attacker who knows a user's ID to act as that user.

    Note: The session cookie cache attack vector is only exploitable when the session cookie cache feature is explicitly enabled.

    How to fix Origin Validation Error?

    Upgrade @better-auth/expo to version 1.7.16, 1.8.0-beta.5 or higher.

    >=1.4.0-beta.6 <1.7.16>=1.8.0-beta.0 <1.8.0-beta.5
    Go back to all versions of this package