← Vulnerability feed

Vulnerability record · CVE-2026-53514 · published 15 July 2026

CVE-2026-53514: Better-auth better auth improper authentication vulnerability

Better Auth · Better Auth

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations recipient endpoints use session.user.email and an invitation ID without sufficient verified-email ownership proof, allowing a user with an unverified session for the invited email address to accept an organization invitation after obtaining the invitation ID. This issue is fixed for the original default behavior in version 1.6.11, while 1.6.14 restored compatibility for built-in opaque invitation IDs and leaves affected configurations requiring secure options.

7.7 CVSS 3.1 High EPSS 0.20% · top 91.1% CWE-287 · Improper authenticationCWE-345 · Insufficient verification of data authenticity
7.7CVSS 3.1 base score
0.20%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
21 Jul 2026Last modified by NVD

Description

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled, the organization plugin's acceptInvitation, rejectInvitation, getInvitation, and listUserInvitations recipient endpoints use session.user.email and an invitation ID without sufficient verified-email ownership proof, allowing a user with an unverified session for the invited email address to accept an organization invitation after obtaining the invitation ID. This issue is fixed for the original default behavior in version 1.6.11, while 1.6.14 restored compatibility for built-in opaque invitation IDs and leaves affected configurations requiring secure options.

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/better-auth/better-auth/commit/23094a628f007f801be6d26e5b15dc5fc6fc4eb8 Patch
https://github.com/better-auth/better-auth/pull/9577 Issue TrackingPatch
https://github.com/better-auth/better-auth/releases/tag/v1.6.11 Release Notes
https://github.com/better-auth/better-auth/security/advisories/GHSA-fmh4-wcc4-5jm3 MitigationVendor Advisory

Track CVE-2026-53514 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.6CVE-2026-53513Better-auth\/sso improper input validation vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST…EPSS 0.25%9.1CVE-2026-53512Better-auth better auth improper authentication vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth toke…EPSS 0.27%8.3CVE-2026-53516Better-auth better auth improper authentication vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, Better Auth's OAuth callback auto-link gate in handleOAut…EPSS 0.29%8.1CVE-2026-53517Better-auth\/oauth-provider race condition vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oaut…EPSS 0.42%7.9CVE-2024-56734Better-auth better auth open redirect vulnerabilityBetter Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versi…EPSS 0.40%7.6CVE-2026-53518Better-auth\/oauth-provider race condition vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/toke…EPSS 0.41%7.6CVE-2026-45337Better-auth better auth improper authorization vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authent…EPSS 0.21%7.1CVE-2026-53515Better-auth\/sso improper privilege management vulnerabilityBetter Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register…EPSS 0.43%

Source: NIST National Vulnerability Database (record CVE-2026-53514), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.