Most recent entries from all

EUVD-2026-338602

fkie_cve-2026-53514

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations recipient endpoints use session.user.email and an invitation ID without sufficient verified-email ownership proof, allowing a user with an unverified session for the invited email address to accept an organization invitation after obtaining the invitation ID. This issue is fixed for the original default behavior in version 1.6.11, while 1.6.14 restored compatibility for built-in opaque invitation IDs and leaves affected configurations requiring secure options.

GHSA-fmh4-wcc4-5jm3 — Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

Affected: npm: better-auth

### Am I affected?

Users are affected if all of the following are true:

- Their application uses `better-auth` with the `organization` plugin (`import { organization } from "better-auth/plugins/organization"`). - Their application enables a sign-up surface that allows arbitrary unverified email registration. Most commonly `emailAndPassword: { enabled: true }` without `requireEmailVerification: true`. - Their application has not set `requireEmailVerificationOnInvitation: true` on the `organization()` options. - Their application invitation distribution flow allows anyone other than the invited mailbox owner to obtain the `invitationId`. Examples: admin UI surfacing the link, copy-paste into chat, forwarded email, mail-forwarding rules at the recipient's domain, link previews logging the URL, or a custom `sendInvitationEmail` integration that sends to a non-owner channel.

If their application set `emailAndPassword: { enabled: true, requireEmailVerification: true }` so unverified rows cannot reach a usable session, they are not affected. Setting `requireEmailVerificationOnInvitation: true` closes `acceptInvitation` and `rejectInvitation`, but `getInvitation` and `listUserInvitations` remain ungated even with that flag.

Fix:

1. Upgrade to `better-auth@1.6.11` or later. 2. If developers cannot upgrade their application, see workarounds below.

### Summary

The organization plugin's `acceptInvitation` endpoint trusts an email-string equality check as proof that the session us…