The better-auth organization plugin's acceptInvitation endpoint relies on a simple email string equality check to verify invitation ownership, without requiring email verification by default. If an application allows unverified email sign-ups (emailAndPassword enabled without requireEmailVerification) and does not set requireEmailVerificationOnInvitation to true, an attacker can pre-register an unverified account with the victim's email address. When the organization admin invites that email, the attacker can use the leaked invitationId to accept the invitation and join the organization. The fix in [email protected] enforces emailVerified checks on acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations endpoints and defaults requireEmailVerificationOnInvitation to true, preventing this attack vector.

An attacker can perform an account takeover on the organization invitation surface by pre-registering an unverified account with the victim's email and using a leaked invitationId to accept the invitation. This allows unauthorized joining of the organization with the invited role, potentially leading to unauthorized access and privilege escalation within the organization.

Upgrade to better-auth version 1.6.11 or later, which enforces email verification on all invitation endpoints by default. If immediate upgrade is not possible, set the organization plugin option requireEmailVerificationOnInvitation to true to block acceptInvitation and rejectInvitation calls from unverified sessions. Additionally, enable requireEmailVerification in emailAndPassword configuration or remove email/password sign-up to prevent unverified account creation. Middleware can also be added to enforce emailVerified status on invitation routes. Note that requireEmailVerificationOnInvitation does not gate getInvitation and listUserInvitations endpoints unless upgraded.