Vulnerability Description
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations recipient endpoints use session.user.email and an invitation ID without sufficient verified-email ownership proof, allowing a user with an unverified session for the invited email address to accept an organization invitation after obtaining the invitation ID. This issue is fixed for the original default behavior in version 1.6.11, while 1.6.14 restored compatibility for built-in opaque invitation IDs and leaves affected configurations requiring secure options.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Better-Auth | Better Auth | < 1.6.11 |
Related Weaknesses (CWE)
References
- https://github.com/better-auth/better-auth/commit/23094a628f007f801be6d26e5b15dcPatch
- https://github.com/better-auth/better-auth/pull/9577Issue TrackingPatch
- https://github.com/better-auth/better-auth/releases/tag/v1.6.11Release Notes
- https://github.com/better-auth/better-auth/security/advisories/GHSA-fmh4-wcc4-5jMitigationVendor Advisory
FAQ
What is CVE-2026-53514?
CVE-2026-53514 is a vulnerability with a CVSS score of 7.7 (HIGH). Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVeri...
How severe is CVE-2026-53514?
CVE-2026-53514 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-53514?
Check the references section above for vendor advisories and patch information. Affected products include: Better-Auth Better Auth.