0-click account takeover in Better Auth

Security firm Strix reports a critical zero-click account takeover in @better-auth/expo, Better Auth's React Native integration. The /expo-authorization-proxy endpoint signed any caller-supplied OAuth state with the app secret, without a login. Because email-verification JWTs used the same HMAC-SHA256 secret, a forged token could change a victim's email and yield a session; the compact session cache was forgeable too, though not the jwe strategy. Fixed in version 1.7.16. The lesson for builders: avoid signing oracles and reusing one key across features.