CVE-2026-53514: Better Auth Authentication Bypass Flaw

CVE-2026-53514 Overview

Better Auth is an authentication and authorization library for TypeScript. CVE-2026-53514 is an authentication bypass vulnerability [CWE-287] in the library's organization plugin. The flaw affects versions prior to 1.6.11, and 1.6.14 and later when requireEmailVerificationOnInvitation: true is not enabled. The acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations endpoints rely on session.user.email and an invitation ID without sufficient verified-email ownership proof. An attacker with an unverified session for the invited email address can accept an organization invitation after obtaining the invitation ID.

Critical Impact
An attacker who obtains an invitation ID outside the invited mailbox can join an organization using an unverified session, gaining unauthorized access to organization resources and membership privileges.

Affected Products

Better Auth versions prior to 1.6.11
Better Auth version 1.6.14 and later when requireEmailVerificationOnInvitation: true is not enabled
Applications using the organization plugin invitation endpoints

Discovery Timeline

2026-07-15 - CVE-2026-53514 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-53514

Vulnerability Analysis

The vulnerability affects the Better Auth organization plugin. The recipient-facing endpoints acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations authenticate the recipient by comparing session.user.email to the invitation record. This equality check treats email-string matching as ownership proof. A session with an unverified email that happens to match the invited address is accepted as the legitimate recipient.

When combined with an invitation ID leaked through logs, referrers, shared links, or predictable identifiers, an attacker can register or sign in using the target email, skip email verification, and call the accept endpoint. The result is unauthorized organization membership tied to an email address the attacker does not control.

Root Cause

The root cause is missing verified-email ownership enforcement in the invitation flow. The code path checked requireEmailVerificationOnInvitation only when the option was explicitly set to true. In default and legacy configurations, session.user.emailVerified was not required before treating the session as the invitation recipient.

Attack Vector

Exploitation requires the attacker to obtain a valid invitation ID and to control an authenticated session with session.user.email matching the invited address. User interaction is required. The upstream fix defaults the verification gate to on and adds an additional error code to block enumeration of invitations across unverified sessions.

typescript

// Source: https://github.com/better-auth/better-auth/commit/23094a628f007f801be6d26e5b15dc5fc6fc4eb8
// Patch in packages/better-auth/src/plugins/organization/routes/crud-invites.ts

// Email-string equality is not ownership proof: a session whose user.email
// matches the invitation but has not been verified must not be treated as
// the invitation recipient. Gate is on by default; apps that intentionally
// allow unverified accept can opt out with `requireEmailVerificationOnInvitation: false`.
// FIXME(next-minor): drop the option and make the gate unconditional.
if (
    (ctx.context.orgOptions.requireEmailVerificationOnInvitation ?? true) &&
    !session.user.emailVerified
) {
    throw APIError.from(
        // ...
    );
}

The patch also introduces a new error code EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION in packages/better-auth/src/plugins/organization/error-codes.ts to signal blocked list and view operations for unverified sessions.

Detection Methods for CVE-2026-53514

Indicators of Compromise

Successful calls to acceptInvitation, rejectInvitation, getInvitation, or listUserInvitations from sessions where emailVerified is false
New organization members whose accounts were created shortly before invitation acceptance and never completed email verification
Invitation IDs appearing in referer headers, application logs, or external analytics endpoints

Detection Strategies

Audit application logs for invitation acceptance events correlated with unverified user records in the identity store
Add server-side telemetry that records session.user.emailVerified at the moment of each invitation endpoint call
Review outbound proxy and CDN logs for invitation IDs exposed in URL parameters or referrers

Monitoring Recommendations

Alert on any invitation acceptance where the recipient account has emailVerified: false
Track anomalous increases in organization membership tied to newly registered accounts
Monitor error rates for the new EMAIL_VERIFICATION_REQUIRED_FOR_INVITATION code after upgrading to detect probing attempts

How to Mitigate CVE-2026-53514

Immediate Actions Required

Upgrade Better Auth to version 1.6.11 or later to receive the default-on verification gate
If running 1.6.14 or later with legacy configuration, explicitly set requireEmailVerificationOnInvitation: true in the organization plugin options
Rotate or invalidate outstanding invitation IDs that may have been exposed outside the recipient mailbox
Review organization membership records for accounts added via unverified sessions and revoke as needed

Patch Information

The fix is available in Better Auth v1.6.11 release. Full technical details are documented in GitHub Security Advisory GHSA-fmh4-wcc4-5jm3, and the code change is available in Pull Request #9577 and the security commit.

Workarounds

Set requireEmailVerificationOnInvitation: true in the organization plugin configuration if immediate upgrade is not possible
Use built-in opaque invitation IDs rather than predictable or externally derivable identifiers
Enforce email verification globally before allowing authenticated sessions to interact with organization endpoints

bash

# Configuration example for the organization plugin
# packages/your-app/src/auth.ts
import { betterAuth } from "better-auth";
import { organization } from "better-auth/plugins";

export const auth = betterAuth({
    plugins: [
        organization({
            requireEmailVerificationOnInvitation: true,
        }),
    ],
});