CVE-2026-53514

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations recipient endpoints use session.user.email and an invitation ID without sufficient verified-email ownership proof, allowing a user with an unverified session for the invited email address to accept an organization invitation after obtaining the invitation ID. This issue is fixed for the original default behavior in version 1.6.11, while 1.6.14 restored compatibility for built-in opaque invitation IDs and leaves affected configurations requiring secure options.

• CWE-287
• CWE-345
• CWE-441
• CWE-862

• https://github.com/better-auth/better-auth/commit/23094a628f007f801be6d26e5b15dc5fc6fc4eb8Patch
• https://github.com/better-auth/better-auth/pull/9577Issue Tracking, Patch
• https://github.com/better-auth/better-auth/releases/tag/v1.6.11Release Notes
• https://github.com/better-auth/better-auth/security/advisories/GHSA-fmh4-wcc4-5jm3Mitigation, Vendor Advisory

Published

Jul 15, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53505Thumbor is an open-source photo thumbnail service by globo.c…7.5
• CVE-2026-5351A weakness has been identified in Trendnet TEW-657BRM 1.00.1…8.8
• CVE-2026-53510Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon:…8.1
• CVE-2026-53511calibre is an e-book manager. Prior to 9.10.0, a malicious E…8.5
• CVE-2026-53512Better Auth is an authentication and authorization library f…9.1
• CVE-2026-53513Better Auth is an authentication and authorization library f…9.6
• CVE-2026-53515Better Auth is an authentication and authorization library f…7.1
• CVE-2026-53516Better Auth is an authentication and authorization library f…8.3
• CVE-2026-53517Better Auth is an authentication and authorization library f…8.1
• CVE-2026-53518Better Auth is an authentication and authorization library f…8.1
• CVE-2026-53519Nezha Monitoring is a self-hostable, lightweight, servers an…9.1
• CVE-2026-5352A security vulnerability has been detected in Trendnet TEW-6…8.8