CVE-2026-53514: 
Better Auth vulnerability analysis and mitigation

CVE-2026-53514 is an authorization bypass vulnerability in the Better Auth TypeScript authentication library's organization plugin, allowing unauthorized acceptance of organization invitations via unverified email session matching. It affects all versions prior to 1.6.11, and versions 1.6.14 and later when requireEmailVerificationOnInvitation: true is not enabled and invitation IDs can be obtained outside the invited mailbox. The vulnerability was reported by @widavies, published to the GitHub Advisory Database on July 7, 2026, and assigned a CVSS v3.1 base score of 7.7 (High) (Github Advisory, Security Advisory).

The root cause is that the organization plugin's invitation recipient endpoints (acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations) used a case-insensitive string comparison between invitation.email and session.user.email as the sole ownership proof, without verifying that the session email was actually verified (session.user.emailVerified === true). This constitutes improper authentication (CWE-287), insufficient verification of data authenticity (CWE-345), missing authorization (CWE-862), and a confused deputy pattern (CWE-441). An attacker can pre-register an account using the victim's email address — which Better Auth's default emailAndPassword configuration allows without requiring email verification — and then use that unverified session to act on invitations targeting that address once the invitation ID is obtained. The invitation ID itself is a 32-character opaque token (~190 bits of entropy), so the realistic attack vector is leakage of the invitation link rather than brute force (Security Advisory, Github Advisory).

A successful exploit allows an attacker holding only an unverified self-issued session and a leaked invitation ID to join an organization at the invited role, effectively performing a pre-account hijacking on the organization invitation surface. The attacker gains the ability to read invitation contents, access organization-scoped data visible to the joined role, and act as a full member of the victim organization — impacting both confidentiality and integrity. Availability is not directly affected, but unauthorized membership could enable further lateral movement within the organization's resources and data (Github Advisory, Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.139% (4th percentile), indicating a low near-term exploitation probability. Exploitation requires the attacker to have low privileges (an unverified account), user interaction (an admin must send an invitation), and the ability to obtain the invitation ID through leakage channels such as admin UIs, forwarded emails, chat links, or link previews (Security Advisory).

1. Identify a target organization: Determine that the target application uses Better Auth with the organization plugin and allows email/password sign-up without mandatory email verification (emailAndPassword: { enabled: true } without requireEmailVerification: true).
2. Pre-register with victim's email: Sign up a new account using the victim's email address (e.g., victim@target.example) before the legitimate owner does. The account will be created with emailVerified: false.
3. Sign in to obtain an unverified session: Authenticate with the pre-registered credentials to obtain a valid session token, even though the email is unverified.
4. Obtain the invitation ID: Acquire the invitation ID through a leakage channel — for example, an admin UI that surfaces invitation links, a forwarded invitation email, a chat message containing the link, link preview logging, or a custom invitation delivery mechanism that sends to a non-owner channel.
5. Call the vulnerable endpoint: Using the unverified session, send an authenticated API request to the acceptInvitation endpoint with the obtained invitationId. The endpoint checks only that invitation.email.toLowerCase() === session.user.email.toLowerCase(), which passes since the attacker registered with the victim's email.
6. Gain unauthorized organization membership: The invitation is accepted and the attacker is added to the organization at the invited role, gaining access to organization-scoped data and resources (Security Advisory, Github Advisory).

• Logs: Authentication logs showing a user account created with a target email address where emailVerified remains false, followed shortly by an acceptInvitation API call from that same session.
• Logs: API access logs recording calls to organization invitation endpoints (/api/auth/organization/accept-invitation, /api/auth/organization/get-invitation, /api/auth/organization/list-user-invitations) from sessions where the user's email is unverified.
• Application Data: Organization membership records showing a new member whose account emailVerified field is false at the time of joining.
• Application Data: User accounts registered with email addresses matching pending organization invitations but with emailVerified: false and no subsequent email verification event.
• Network: Unexpected or rapid sequence of sign-up → sign-in → invitation acceptance API calls for the same email address in a short time window (Security Advisory).

The primary fix is to upgrade Better Auth to version 1.6.11 or later, which makes requireEmailVerificationOnInvitation default to true and extends the verified-email gate to all four recipient endpoints (v1.6.11 Release). For applications on version 1.6.14 or later, explicitly set organization({ requireEmailVerificationOnInvitation: true }) to enforce verified email ownership for invitation actions, as this version restored compatibility for built-in opaque invitation IDs but left the configuration security-dependent (Security Advisory). If upgrading is not immediately possible, the following workarounds apply in order of preference: (1) enable emailAndPassword: { requireEmailVerification: true } to prevent unverified sessions from being created; (2) add middleware to organization invitation routes that asserts session.user.emailVerified === true; (3) avoid exposing invitation IDs outside the invited mailbox by restricting admin UIs and invitation delivery channels.