CVE-2026-54320

Name of the Vulnerable Software and Affected Versions Daytona versions prior to 0.184.0

Description Organization invitations could be accepted or declined by users with an email address matching the invitation that had not been verified. While the system uses OIDC (OpenID Connect, an identity layer on top of the OAuth 2.0 protocol) to match the invitation target email against the caller's token, the paths for accepting and declining invitations did not enforce email verification. This allows an actor using an identity provider that permits self-service signup and issues sessions before verification to register an email matching a pending invitation and join the target organization with the assigned role, which could be as high as Owner.

Recommendations Update to version 0.184.0.