CVE-2026-54320: Daytona Unverified Email Invitation Acceptance Privilege Escalation

Technical summary

The vulnerability stems from inconsistent enforcement of email verification across Daytona's invitation workflow. While organization creation enforces email verification, the invitation accept and decline endpoints authenticate via OIDC token matching (comparing the caller's email claim against the invitation target email) but omit verification checks. An attacker registers a new account on a federated identity provider that allows pre-verified session issuance, uses an email matching a pending invitation, and calls the accept endpoint. Because the OIDC token contains an unverified email matching the invitation, the request succeeds. The decline path shares the same flaw. This affects CWE-287 (Improper Authentication) and CWE-863 (Incorrect Authorization).

Business impact

An attacker could gain unauthorized access to organizations within a Daytona instance, potentially at the Owner privilege level, without legitimate invitation or credential compromise. This enables lateral movement, data exfiltration from organization workspaces, code injection into AI workflows, and infrastructure sabotage. The risk is particularly acute in multi-tenant deployments where organizations isolate different teams or customers. Remediation should be prioritized for instances hosting sensitive AI workloads or managing infrastructure across multiple business units.

Affected systems

Daytona versions prior to 0.184.0 are affected. The vulnerability is present in the invitation accept and decline code paths and impacts any organization using Daytona with a federated identity provider (such as Auth0, Okta, or any OIDC-compliant provider) that permits account registration and session issuance before email verification. On-premises and cloud deployments are equally at risk.

Exploitability

Exploitation requires low pre-existing access: the attacker must be able to register an account on the identity provider used by the target Daytona instance. This is typically feasible on self-service OIDC providers. No special network position or tools are needed beyond normal authentication flows. The attack surface is unauthenticated from Daytona's perspective (the attacker is a new user), though they must be known to the identity provider. The CVSS score of 8.4 reflects the high impact (confidentiality and integrity compromise, some availability impact) offset by the requirement to identify and target a specific pending invitation and the need for identity provider control.

Remediation

Upgrade to Daytona 0.184.0 or later immediately. The patch enforces email verification on both invitation accept and decline endpoints, aligning them with the verification requirement already present in organization creation. After patching, audit recent organization memberships for anomalies, especially Owner-level additions, and revoke any suspicious invitations or memberships. Review OIDC provider configurations to ensure email verification is enforced before session issuance, where possible.

Patch guidance

Daytona 0.184.0 contains the fix. Verify against the official Daytona release notes and apply the update to all instances running prior versions. If you are on a managed Daytona service, the vendor should provide an automated upgrade path; consult your service provider for timing. Test the patch in a non-production environment first to confirm compatibility with existing organization structures and workflows.

Detection guidance

Look for invitations that were accepted or declined by users whose email address matches the invitation target but whose email verification status is unconfirmed or missing in your identity provider logs. Cross-reference Daytona organization membership events (especially Owner additions) with identity provider session logs to identify cases where a session was issued before email verification completed. Monitor for failed organization creation attempts followed by successful invitation accepts with unverified emails—this pattern suggests attempted exploitation.

Why prioritize this

This is a HIGH-severity vulnerability because it enables privilege escalation and unauthorized organizational access without compromising existing credentials. It directly affects access controls in a runtime platform handling sensitive AI code execution. The flaw is easy to exploit once a pending invitation is identified, and the impact—Owner-level organizational compromise—is severe. Although it currently carries no active exploit surveillance (not in CISA KEV), the straightforward nature of the attack makes proactive patching essential.

Risk score, explained

The CVSS 3.1 score of 8.4 reflects: high confidentiality and integrity impact (access to organization code and data), low availability impact (the attack does not inherently disrupt service), low attack complexity (standard account registration and API calls), and the requirement for partial prior access (ability to register on the identity provider). The attack is network-accessible and does not require user interaction, but the attacker's identity is constrained by the identity provider's registration policies. Across multi-tenant deployments, this scores as a scope-change scenario, elevating severity.

Frequently asked questions