CVE-2026-54320 Details
Description
Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization invitations could be accepted (and declined) by a user whose email matched the invitation but had not been verified. Daytona authenticates users via OIDC and matches an invitation's target email against the email in the caller's token, but the invitation accept and decline paths did not require that email to be verified, unlike organization creation, which already enforced verification. On identity providers that allow self-service signup and issue a session before the email is verified, an actor could register an address matching a pending invitation, leave it unverified, and accept the invitation, joining the target organization with the role the invitation carried (up to Owner). This vulnerability is fixed in 0.184.0.
A vulnerability in Daytona prior to version 0.184.0 allows users to accept organization invitations with unverified email addresses. Daytona uses OpenID Connect (OIDC) for user authentication and matches invitation emails with those in the user's token. However, the processes for accepting and declining invitations did not require email verification, unlike organization creation, which did. This flaw enables users to register an unverified email that matches a pending invitation, accept it, and join the organization with the associated role, potentially up to Owner.
Users are advised to upgrade to Daytona version 0.184.0 or later, where the invitation acceptance process now requires email verification, aligning it with the organization's creation protocol. For those unable to upgrade immediately, it is recommended to ensure that the identity provider does not issue sessions for unverified email addresses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 23, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/daytonaio/daytona/security/advisories/GHSA-m6hx-cffh-3f3h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Daytonaio Daytona | <= 0.183.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |