From 6efc75268210d1f58f9de397fe44735679e1ee2b Mon Sep 17 00:00:00 2001
From: Bereket Engida <86073083+Bekacru@users.noreply.github.com>
Date: Thu, 13 Mar 2025 13:02:23 +0300
Subject: [PATCH] fix: on change email request for unverified emails should use
 the newEmail on verification token payload (#1801)

---
 .../src/api/routes/update-user.test.ts        | 19 +++++++++++++++++++
 .../better-auth/src/api/routes/update-user.ts |  2 +-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/packages/better-auth/src/api/routes/update-user.test.ts b/packages/better-auth/src/api/routes/update-user.test.ts
index 0621c2a41f..f8c53df2c3 100644
--- a/packages/better-auth/src/api/routes/update-user.test.ts
+++ b/packages/better-auth/src/api/routes/update-user.test.ts
@@ -89,6 +89,25 @@ describe("updateUser", async () => {
 			},
 		});
 		expect(session.user.email).toBe(newEmail);
+		expect(session.user.emailVerified).toBe(false);
+	});
+
+	it("should verify email", async () => {
+		await client.verifyEmail({
+			query: {
+				token: emailVerificationToken,
+			},
+			fetchOptions: {
+				headers,
+			},
+		});
+		const session = await client.getSession({
+			fetchOptions: {
+				headers,
+				throw: true,
+			},
+		});
+		expect(session.user.emailVerified).toBe(true);
 	});
 
 	it("should send email verification before update", async () => {
diff --git a/packages/better-auth/src/api/routes/update-user.ts b/packages/better-auth/src/api/routes/update-user.ts
index 80c5a2372a..ff6a27db53 100644
--- a/packages/better-auth/src/api/routes/update-user.ts
+++ b/packages/better-auth/src/api/routes/update-user.ts
@@ -612,8 +612,8 @@ export const changeEmail = createAuthEndpoint(
 			if (ctx.context.options.emailVerification?.sendVerificationEmail) {
 				const token = await createEmailVerificationToken(
 					ctx.context.secret,
-					ctx.context.session.user.email,
 					newEmail,
+					undefined,
 					ctx.context.options.emailVerification?.expiresIn,
 				);
 				const url = `${