BETTER-AUTH · GHSA-c85h-5mrr-mgx4 · Package
FIX → 1.8.0-beta.5 +1
The better-auth organization plugin checks invitation roles without trimming whitespace, so a role value like " owner" bypasses the rule that only owners can invite owners. An organization admin can use this to create a real owner account in their organization, then delete the original owners.
first public Nov 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
You are exposed if your app uses the better-auth organization plugin from 1.5.5 or later and any role other than the creator role can create invitations; the default roles let organization admins do this. Apps that do not use the organization plugin, or where only the creator role can invite, are not affected.
Not affected if no-organization-plugin, only-creator-can-invite
Who cares better-auth, node, organizations, self-hosted
npm ls better-auth and compare it to the fixed versions below.owner by default) can create invitations.admin, owner. Do not trim them in place.You are affected if you use the organization plugin from better-auth 1.5.5 or later, and a role other than the creator role can create invitations. With the default roles, organization admins can.
You are not affected if only the creator role (owner by default) can create invitations.
The organization plugin stops members who are not owners from inviting someone as an owner. A role value with extra whitespace passed this check, so an admin could invite an account they control as an owner.
An organization admin, or another non-creator role that can invite, can create a real owner account in the same organization. That owner can delete the organization and remove the original owners. The escalation stays inside an organization where the attacker can already invite members.
Upgrade better-auth to 1.7.16, or to 1.8.0-beta.5 on the beta line.
Role lists are now trimmed and split on commas wherever they are stored or compared, and invitations with an empty role are rejected.
Remove the invite permission from every role except the creator role, or reject invitation roles with leading or trailing whitespace before they reach Better Auth.
Audit existing invitations and memberships for role values that change when trimmed. Do not trim them in place: trimming admin, owner makes that member a real owner. Review owners invited by such members.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.8.0-beta.5 +1
1.7.16 for the 1.7 line (affected from 1.5.5 up to 1.7.16).1.8.0-beta.5 for the 1.8 beta line (affected from 1.8.0-beta.0 up to 1.8.0-beta.5).The creator role check compared the raw role string, while later checks split and trimmed it. A value such as " owner" passed the first check and became owner when the invitation was accepted.