A flaw in the Better Auth library’s organization plugin permits a user who has a session authenticated with the invited email address—yet whose email has not been verified—to accept an organization invitation. The vulnerable endpoints (acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations) accept the session’s user.email together with an invitation ID but fail to enforce verified‑email ownership proof when the configuration option requireEmailVerificationOnInvitation is false and invitation IDs can be obtained outside the invited mailbox. Consequently, an attacker who obtains a valid invitation ID can call these endpoints with an unverified session and have the invitation accepted, granting the attacker unauthorized access to the organization. This issue was fixed in v1.6.11, restoring the default behavior; v1.6.14 reintroduced compatibility for opaque invitation IDs but left configurations requiring secure options.

The issue affects the Better Auth library for TypeScript. Any deployment using a version prior to 1.6.11, or 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation is not enabled, is vulnerable. Updating to v1.6.11 or later with the default configuration resolves the problem; alternatively, enabling strict email verification or restricting external access to invitation IDs mitigates the risk.

The CVSS score of 7.7 indicates a high severity, while an EPSS score of less than 1% suggests that it is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring the attacker to first obtain a valid invitation ID and to create or hijack a session for the invited email address that has not completed verification. Once those prerequisites are met, the attacker can invoke the vulnerable endpoints to accept the invitation and gain unauthorized access to the organization’s data.