{"id":"CVE-2026-67329","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-01T13:17:03.523","lastModified":"2026-10-23T23:10:00.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state."},{"lang":"es","value":"Las versiones de @better-auth/stripe >= 1.4.11 y anterior a 1.6.21, y >= 1.7.0-beta.0 y anterior a 1.7.0-beta.10, contienen un bypass de autorización en las acciones de suscripción de la organización. El middleware valida el ID de la organización tomado de la cadena de consulta de la solicitud contra el callback authorizeReference, pero el gestor lee el ID de la organización solo del cuerpo de la solicitud y recurre a la organización activa del llamante de su sesión. Cuando estos difieren, un miembro autenticado de múltiples organizaciones puede realizar acciones de suscripción (cancelar, cambiar plan, restaurar, acceso al portal de facturación) contra una organización a la que pertenecen pero que no deberían gestionar, y puede acceder a los detalles de facturación de otra organización incluyendo métodos de pago, facturas y estado de la suscripción."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"better-auth","product":"stripe","defaultStatus":"unaffected","packageURL":"pkg:npm/%40better-auth/stripe","versions":[{"version":"1.4.11","lessThan":"1.6.21","versionType":"semver","status":"affected"},{"version":"1.6.21","versionType":"semver","status":"unaffected"}]},{"vendor":"better-auth","product":"stripe","defaultStatus":"unaffected","packageURL":"pkg:npm/%40better-auth/stripe","versions":[{"version":"1.7.0-beta.0","lessThan":"1.7.0-beta.10","versionType":"semver","status":"affected"},{"version":"1.7.0-beta.10","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-03T18:20:04.118634Z","id":"CVE-2026-67329","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-h3rm-78g3-j7cp","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/better-auth-stripe-before-authorization-bypass-via-organization-subscription","source":"disclosure@vulncheck.com"}]}