CVE-2026-53514

Name of the Vulnerable Software and Affected Versions Better Auth versions prior to 1.6.11 Better Auth versions 1.6.14 and later

Description An issue exists in the organization plugin where the acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations endpoints do not sufficiently verify email ownership. The system relies on a simple email string equality check between the session user and the invitation recipient. If an attacker can register an unverified account using a victim's email address and obtain the invitationId, they can accept the invitation and join the organization with the assigned role. This allows for account takeover via pre-account hijacking, enabling the attacker to access organization-scoped data.

Recommendations Upgrade to version 1.6.11 or later. Set organization({ requireEmailVerificationOnInvitation: true }) to block unverified sessions from accepting or rejecting invitations. Set emailAndPassword.requireEmailVerification: true to prevent the creation of unverified accounts. Implement middleware on organization invitation routes to ensure session.user.emailVerified is set to true.