@better-auth/stripe EUVD-2026-51806

Four conditions must simultaneously be true for exploitation. First, subscription.enabled: true must be set in the @better-auth/stripe plugin configuration - this is not the default state. Second, organization.enabled: true must be configured along with a developer-supplied authorizeReference callback; without this callback the org authorization gate does not exist. Third, the attacker must be an authenticated member (any role) of at least two organizations on the platform: one organization they are permitted to manage (used to pass the middleware check via the query string) and the victim organization. Fourth, the attacker's active session organization must be set to the victim organization before the malicious request is sent, since the handler falls back to session.activeOrganizationId. The attack is bounded to organizations the attacker already belongs to - arbitrary cross-tenant attacks against unrelated organizations are not possible. Deployments using only user-level subscriptions (no org subscriptions) are entirely unaffected regardless of version.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N places this as a network-accessible, low-complexity, low-privilege attack, yielding a 7.1 High score - primarily driven by the VI:H (high integrity impact) reflecting ability to cancel, change, or restore subscriptions. However, there are meaningful real-world limiting factors that the raw score does not capture. Exploitation requires four simultaneously true deployment conditions: organization subscriptions enabled, the authorizeReference callback configured, the attacker authenticated as a member of at least two organizations, and the attacker's active session already set to the target org. The attack surface is strictly bounded - the victim organization must be one the attacker already belongs to, ruling out arbitrary cross-tenant attacks against unrelated organizations. No KEV listing and no public POC code have been identified at time of analysis, suggesting limited observed exploitation. The VC:L (low confidentiality) component reflects that billing details including payment methods, invoices, and subscription state are accessible. ENISA EUVD-2026-51806 independently tracks this. Overall: this is a genuine High-severity finding for any multi-tenant SaaS using organization billing, but the configuration prerequisites reduce the realistic population of exposed deployments.

An attacker who holds low-privilege membership in Organization A (the victim, set as their active session org) and also manages Organization B crafts a POST request to a subscription action endpoint, placing Organization B's ID in the query string so the middleware's authorizeReference check approves the request, while deliberately omitting the organization ID from the request body. The handler finds no body org ID, falls back to the session's active org (Organization A), and executes the billing action - such as subscription cancellation or plan downgrade - against Organization A. No public POC exists, but the exploit path is mechanically trivial given the full parameter manipulation details published in the GHSA advisory.