CVE-2026-53514: Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin

The organization plugin’s acceptInvitation endpoint trusts an email-string equality check as proof that the session user owns the invited address. With Better Auth’s stock emailAndPassword: { enabled: true } configuration, requireEmailVerification defaults to false, so an attacker can sign up a row keyed to victim@target.example (auto-signed-in, emailVerified: false) before the legitimate owner. When an organization admin invites that address, the attacker presents the invitationId and accepts the invitation, joining the organization at the invited role.