EUVD-2026-38566Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Network-reachable invitation endpoint; PR:N because attacker registers a fresh account (no pre-existing privilege); AC:H due to required IdP misconfiguration and knowledge of invited email; scope changes to target org.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization invitations could be accepted (and declined) by a user whose email matched the invitation but had not been verified. Daytona authenticates users via OIDC and matches an invitation's target email against the email in the caller's token, but the invitation accept and decline paths did not require that email to be verified, unlike organization creation, which already enforced verification. On identity providers that allow self-service signup and issue a session before the email is verified, an actor could register an address matching a pending invitation, leave it unverified, and accept the invitation, joining the target organization with the role the invitation carried (up to Owner). This vulnerability is fixed in 0.184.0.
AnalysisAI
Authentication bypass in Daytona prior to 0.184.0 allows attackers to join organizations via pending invitations using unverified email addresses. The invitation accept and decline paths failed to enforce email verification (unlike organization creation), so on OIDC identity providers permitting self-service signup with pre-verification sessions, an attacker registering an email matching a pending invite can claim it and inherit the assigned role - up to Owner. No public exploit identified at time of analysis, but the path to full Owner-level organization takeover makes this a high-priority fix.
Technical ContextAI
Daytona is a runtime platform for executing AI-generated code and agent workflows, authenticating users via OpenID Connect (OIDC). The flaw is a CWE-287 (Improper Authentication) defect: while the organization creation flow correctly required the OIDC token's email claim to be marked verified, the invitation accept/decline handlers only matched the email string without checking the email_verified claim. This creates an inconsistency in the trust model - Daytona effectively delegates email ownership verification to the IdP, but only enforces that delegation on one code path. Identity providers like Auth0, Keycloak, or generic OIDC setups configured for self-service signup commonly issue a valid session token before email verification completes, which is the exact precondition the bug requires. Per the CPE, all daytonaio:daytona versions prior to 0.184.0 are affected.
RemediationAI
Vendor-released patch: upgrade to Daytona 0.184.0 or later, which adds the missing email-verified check to the invitation accept and decline paths; see https://github.com/daytonaio/daytona/security/advisories/GHSA-m6hx-cffh-3f3h. As a compensating control until upgrade, reconfigure the upstream OIDC identity provider to require email verification before issuing a session (most IdPs expose this as a 'require verified email' or 'block unverified logins' policy), accepting the trade-off of slower user onboarding. Operationally, audit current organization memberships for accounts that joined via invitation against unfamiliar email domains, and consider revoking and reissuing any pending invitations created before patching to invalidate any unverified squatters.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today