CVE-2026-54320
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk12th percentile — higher than 12% of all known CVEs
Summary
In versions prior to 0.184.0, users could accept or decline organization invitations even if their email address was not verified. Daytona's authentication system did not require email verification for these actions, creating a risk of unauthorized access.
Risk Assessment
The organization may be exposed to unauthorized team memberships, potentially leading to loss of control over access to resources and data. Potential intruders could gain access to the organization with the permissions assigned in the invitation.
Recommendation
It is recommended to upgrade to version 0.184.0 or later to mitigate this vulnerability. Additionally, implementing further email verification checks for all invitation-related actions is advisable.
Original NVD description (English source)
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization invitations could be accepted (and declined) by a user whose email matched the invitation but had not been verified. Daytona authenticates users via OIDC and matches an invitation's target email against the email in the caller's token, but the invitation accept and decline paths did not require that email to be verified, unlike organization creation, which already enforced verification. On identity providers that allow self-service signup and issue a session before the email is verified, an actor could register an address matching a pending invitation, leave it unverified, and accept the invitation, joining the target organization with the role the invitation carried (up to Owner). This vulnerability is fixed in 0.184.0.