# Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

Better Auth organization plugin trusted email-string equality for invitation acceptance, letting an attacker who pre-registered the victim's unverified email join the org with a leaked invitationId.

- Payout: Research
- Severity: high
- Program: Better Auth
- Found by: widavies
- Disclosed: 2026-07-07
- CVE: CVE-2026-53514
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-fmh4-wcc4-5jm3
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-fmh4-wcc4-5jm3
- Tags: area:web domain:web impact:ato impact:internal-access kind:research platform:ghsa sev:high tech:nodejs technique:source-review vuln:access-control vuln:account-takeover vuln:auth-bypass

**Target:** organization plugin invitation endpoints (acceptInvitation, rejectInvitation, getInvitation, listUserInvitations)
**Root cause:** acceptInvitation treats case-insensitive email-string equality between invitation.email and session.user.email as proof of ownership, without requiring session.user.emailVerified. requireEmailVerificationOnInvitation defaults to false and only gates accept/reject, leaving getInvitation and listUserInvitations ungated entirely.
**Steps:**
1. Attacker signs up with `victim@target.example` on an app using `emailAndPassword: { enabled: true }` without `requireEmailVerification: true`; row is created auto-signed-in with `emailVerified: false`.
2. Org admin invites `victim@target.example`; invitationId is generated.
3. Attacker obtains the invitationId via link leakage (admin UI, chat, forwarded email, mail-forwarding, link previews, custom sendInvitationEmail).
4. Attacker calls `acceptInvitation` with the invitationId while holding the unverified session; email match passes and attacker joins the org at the invited role.
5. Optionally call `getInvitation`/`listUserInvitations` to read invitation contents and org-scoped data.
**How found:** Reporter observed that the recipient gate only compares lowercased email strings and that requireEmailVerificationOnInvitation defaults to false and covers only accept/reject, leaving getInvitation and listUserInvitations ungated; same trust-primitive class as OAuth auto-link GHSA-g38m-r43w-p2q7 where email equality was mistaken for ownership.
**Exploitation:** Pre-register the victim's email before the legitimate owner, wait for an admin invitation to that address, obtain the leaked invitationId (32 chars over [a-zA-Z0-9], ~190 bits, so leakage not brute force), then accept the invitation with the unverified session to join the organization at the invited role and read org-scoped data.
**Insight:** When a system gates an action on email equality, check whether the email can be claimed unverified before the real owner (pre-account hijacking) and whether the verification flag is actually enforced on every endpoint in the family, not just the write paths.