{
  "cveId": "CVE-2026-121802",
  "checkedAt": "2026-11-04T03:32:32.843Z",
  "method": "Published package in-process auth handlers with an in-memory database, synthetic state records and dummy provider configuration",
  "runtime": "Node.js v24.22.1",
  "networkDuringChecks": "Live Vercel session policy deny-all, read back before checks; IPv6 disabled",
  "packages": [
    {
      "variant": "old",
      "name": "better-auth",
      "version": "1.7.15",
      "integrity": "sha512-x2HmrQZy9yTG3H9iJ9pvaVGmLbI++ynOcJ3SGqFZnhEDscQSpG+1P9Xv41ceje2vw7dVE5+BbImDGneyhtW2Vg==",
      "entrySha256": "d713cb623436fc49d7d488bab4e25a159622e4c0fc6aa5bacfd55d34f873d84a"
    },
    {
      "variant": "old",
      "name": "@better-auth/expo",
      "version": "1.7.15",
      "integrity": "sha512-1FyZgypFzZMhCK9c9FNLWPRUZ8xDVWrl5hlo7V5de6zxK8dDHA+Oea3XrhaGnOk0nDMvXvQp4UyQ+ftEwysVgQ==",
      "entrySha256": "d419827aea2ae3bfee3c71fdbd8e132355f8b007357fe480dfecce0db16ba34f"
    },
    {
      "variant": "fixed",
      "name": "better-auth",
      "version": "1.7.16",
      "integrity": "sha512-ur6xj8jeUC9lcH8ni9LrwB4FiFMPDTWFJmb89yZ2SHsFSUobYgGMFsMq6aOorlVtqRr9ckTemRunCR6vzsO65Q==",
      "entrySha256": "bb2f15754f53a478596ba743f931262620ad3fbf97fdcf87ccb7aef8edd4ae17"
    },
    {
      "variant": "fixed",
      "name": "@better-auth/expo",
      "version": "1.7.16",
      "integrity": "sha512-kThN34FJzXaF/bKNel5oXAP5DbuDp9DkiTe3h5Vm9LeJa7rN3kujaSC71NmMJpzQ+Y5ypeV2o5unRVVPzqucAw==",
      "entrySha256": "a62dd7042b43af389f70c217d3f2785075cb711fca3ab9fa7d8ade1be392c077"
    }
  ],
  "cases": [
    {
      "case": "unissued_state_configured_provider",
      "old": {
        "status": 302,
        "cookie": true
      },
      "fixed": {
        "status": 302,
        "cookie": false
      }
    },
    {
      "case": "unexpired_server_state_record",
      "old": null,
      "fixed": {
        "status": 302,
        "cookie": true
      }
    },
    {
      "case": "expired_server_state_record",
      "old": null,
      "fixed": {
        "status": 302,
        "cookie": false
      }
    },
    {
      "case": "unrelated_provider_origin",
      "old": {
        "status": 302,
        "cookie": true
      },
      "fixed": {
        "status": 400,
        "cookie": false
      }
    }
  ],
  "distinctAssertions": 6,
  "distinctAssertionsPassed": 6,
  "totalHandlerRequests": 8,
  "additionalRequests": "Two old-package opaque-state controls repeated the old behavior; they do not establish old issued/expired record semantics.",
  "sourceCommit": "93edae16ebae910f57df360d0f43c2dcfa9f8c20",
  "limits": [
    "No external HTTP or OAuth exchange",
    "No account takeover attempt",
    "No complete mobile application, SSO, production deployment or secret-rotation integration test",
    "Beta release not executed"
  ],
  "harnessIncluded": false
}