CVE-2026-54320 is an improper authentication vulnerability (CWE-287) in daytonaio's Daytona product affecting versions before 0.184.0. The vulnerability allows a user to accept or decline organization invitations if their email matches the invitation target email, even if the email is unverified. Since Daytona authenticates users via OIDC and matches the invitation email against the caller's token email without requiring verification on invitation acceptance, an attacker can exploit identity providers that issue sessions before email verification. By registering an email matching a pending invitation and leaving it unverified, the attacker can accept the invitation and gain the associated organization role, potentially up to Owner. The vulnerability is resolved in version 0.184.0.

An attacker can gain unauthorized access to an organization by accepting an invitation without verifying the email address, potentially obtaining high-privilege roles such as Owner. This compromises confidentiality and integrity of the organization and its resources. The vulnerability has a high CVSS score of 8.4, indicating significant impact on confidentiality, integrity, and limited availability.

Upgrade Daytona to version 0.184.0 or later, where the vulnerability is fixed by enforcing email verification on invitation acceptance. No other mitigations are specified. Patch status is confirmed fixed in 0.184.0.