7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-53514

CVE-2026-53514: Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations recipient endpoints use session.user.email and an invitation ID without sufficient verified-email ownership proof, allowing a user with an unverified session for the invited email address to accept an organization invitation after obtaining the invitation ID. This issue is fixed for the original default behavior in version 1.6.11, while 1.6.14 restored compatibility for built-in opaque invitation IDs and leaves affected configurations requiring secure options.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-53514

CVE-2026-53514:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
better-auth	npm	< 1.6.11	1.6.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-fmh4-wcc4-5jm3, allowed an attacker to accept organization invitations on behalf of a victim. This was possible because the better-auth organization plugin did not properly verify email ownership. An attacker could create an account using a victim's email address and, if they obtained an invitation link meant for the victim, could accept it and join the organization.

The root cause was that the invitation-related endpoints (acceptInvitation, rejectInvitation, getInvitation, listUserInvitations) only checked if the session user's email string matched the email in the invitation. They did not check if the emailVerified flag for the user was true.

The patch addresses this by making two key changes in packages/better-auth/src/plugins/organization/routes/crud-invites.ts:

It changes the default for the requireEmailVerificationOnInvitation option from false to true. This means that, by default, email verification is now required.
It adds the email verification check to the getInvitation and listUserInvitations functions, which previously had no such protection. The check was already present but optional in acceptInvitation and rejectInvitation.

By enforcing email verification across all four endpoints by default, the patch ensures that only a user who has proven control of an email address can act on invitations sent to that address.

Vulnerable functions

acceptInvitation

packages/better-auth/src/plugins/organization/routes/crud-invites.ts

The `acceptInvitation` function was vulnerable because it did not enforce email verification by default. An attacker could create an account with a victim's email address (unverified) and use a leaked invitation link to join an organization. The patch changes the default behavior to require email verification.

rejectInvitation

packages/better-auth/src/plugins/organization/routes/crud-invites.ts

Similar to `acceptInvitation`, the `rejectInvitation` function was vulnerable as it did not enforce email verification by default. This allowed an attacker with an unverified account to reject invitations on behalf of a victim. The patch enforces email verification by default.

getInvitation

packages/better-auth/src/plugins/organization/routes/crud-invites.ts

The `getInvitation` function was vulnerable because it lacked any email verification check. An attacker with an unverified account matching a victim's email could view invitation details. The patch adds a mandatory email verification check.

listUserInvitations

packages/better-auth/src/plugins/organization/routes/crud-invites.ts

The `listUserInvitations` function was vulnerable as it did not perform an email verification check for authenticated sessions. This allowed an attacker with an unverified account to list all invitations for a victim's email address. The patch introduces an email verification check for sessions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.