EUVD-2026-51806
GHSA-mp8j-p2mc-4hgv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector (AV:N), low-privilege auth required (PR:L); high integrity from subscription manipulation, low confidentiality from billing data exposure, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state.
AnalysisAI
Cross-organization billing authorization bypass in @better-auth/stripe allows authenticated members of multiple organizations to perform subscription actions - including plan cancellation, plan changes, restoration, and billing portal access - against organizations whose billing they should not control. The root cause is a parameter source mismatch: middleware validates the organization ID from the request query string, while the route handler resolves it from the request body and falls back to the caller's active session organization, enabling an attacker to pass authorization for one org while the action executes against another. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects a network-accessible, low-complexity attack path with high integrity impact on billing state.
Technical ContextAI
The @better-auth/stripe npm package (cpe:2.3:a:better-auth:stripe) is an authentication and billing integration plugin that maps Stripe subscription state to the better-auth organization model. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR variant in which the authorization check and the privileged operation consume different instances of the same key. The plugin's org subscription middleware reads the organization ID from either the request body or query string and passes it to the developer-configured authorizeReference callback. The route handler for subscription actions then independently re-reads the organization ID from the request body only, falling back to session.activeOrganizationId when absent. Because the query string is visible to middleware but ignored by the handler, these two resolutions can diverge. The fix, committed at 29fbcb573261242d8a05b131a9d39c9ae4352b06, resolves the org ID once in middleware and threads that single resolved value into the handler, eliminating the divergence.
RemediationAI
Upgrade @better-auth/stripe to version 1.6.21 or later on the stable release line, or to 1.7.0-beta.10 or later on the beta line; these are the vendor-confirmed patched versions per GHSA-h3rm-78g3-j7cp. The upstream fix is traceable to commit 29fbcb573261242d8a05b131a9d39c9ae4352b06 in the better-auth GitHub repository. If an immediate upgrade is not feasible, the advisory provides a targeted workaround: modify the authorizeReference callback to return false whenever the requested organization ID does not equal session.activeOrganizationId. The compensating control snippet is if (referenceId !== session.activeOrganizationId) { return false; }, which must be combined with any existing role checks. The trade-off of this workaround is that it prevents users from performing subscription actions on an org unless that org is already their active session org - applications may need UX logic to prompt users to switch their active org before performing billing operations. Advisory and VulnCheck analysis are available at https://www.vulncheck.com/advisories/better-auth-stripe-before-authorization-bypass-via-organization-subscription.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-b
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully tak
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromi
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today