CVE-2026-67329
Received Received - Intake

Authorization Bypass in Better Auth Stripe Subscription Actions

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67329
EUVD
EUVD-2026-51806

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
better-auth stripe From 1.4.11 (inc) to 1.6.21 (exc)
better-auth stripe From 1.7.0-beta.0 (inc) to 1.7.0-beta.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the @better-auth/stripe library affecting versions between 1.4.11 and 1.6.21, and beta versions 1.7.0-beta.0 to 1.7.0-beta.10. The issue occurs when the middleware validates an organization ID from the request query string but the handler reads it from the request body or session. This allows authenticated users to perform subscription actions on organizations they belong to but should not manage, potentially accessing billing details of other organizations.

Impact Analysis

If you are a user of the affected @better-auth/stripe versions, an attacker with access to your account could manipulate subscription actions or view billing details of organizations you belong to but do not manage. This could lead to unauthorized cancellations, plan changes, or exposure of sensitive payment information.

Mitigation Strategies

Update @better-auth/stripe to version 1.6.21 or later, or 1.7.0-beta.10 or later. This vulnerability is due to authorization bypass in organization subscription actions, so patching the library is critical.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67329. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart