CVE-2026-67329 (GCVE-0-2026-67329)

Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-10-08 15:24
VLAI
Title
@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription
Summary
@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 18:20 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6748 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
better-auth stripe Affected: 1.4.11 , < 1.6.21 (semver)
Unaffected: 1.6.21 (semver)
guessed Create a notification for this product.
better-auth stripe Affected: 1.7.0-beta.0 , < 1.7.0-beta.10 (semver)
Unaffected: 1.7.0-beta.10 (semver)
guessed Create a notification for this product.
Date Public
2026-06-26 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67329",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T18:20:04.118634Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-03T18:23:06.596Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40better-auth/stripe",
          "product": "stripe",
          "vendor": "better-auth",
          "versions": [
            {
              "lessThan": "1.6.21",
              "status": "affected",
              "version": "1.4.11",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.6.21",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40better-auth/stripe",
          "product": "stripe",
          "vendor": "better-auth",
          "versions": [
            {
              "lessThan": "1.7.0-beta.10",
              "status": "affected",
              "version": "1.7.0-beta.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.7.0-beta.10",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*",
                  "versionEndExcluding": "1.6.21",
                  "versionStartIncluding": "1.4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*",
                  "versionEndExcluding": "1.7.0-beta.10",
                  "versionStartIncluding": "1.7.0-beta.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-06-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "@better-auth/stripe versions \u003e= 1.4.11 and \u003c 1.6.21, and \u003e= 1.7.0-beta.0 and \u003c 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller\u0027s active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization\u0027s billing details including payment methods, invoices, and subscription state."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T15:24:07.826Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-h3rm-78g3-j7cp)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-h3rm-78g3-j7cp"
        },
        {
          "name": "VulnCheck Advisory: @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/better-auth-stripe-before-authorization-bypass-via-organization-subscription"
        }
      ],
      "title": "@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67329",
    "datePublished": "2026-08-01T12:22:18.131Z",
    "dateReserved": "2026-07-29T13:07:47.015Z",
    "dateUpdated": "2026-10-08T15:24:07.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-67329",
      "date": "2026-10-24",
      "epss": "0.00313",
      "percentile": "0.23051"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageURL": "pkg:npm/%40better-auth/stripe",
                "product": "stripe",
                "vendor": "better-auth",
                "versions": [
                  {
                    "lessThan": "1.6.21",
                    "status": "affected",
                    "version": "1.4.11",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "1.6.21",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "packageURL": "pkg:npm/%40better-auth/stripe",
                "product": "stripe",
                "vendor": "better-auth",
                "versions": [
                  {
                    "lessThan": "1.7.0-beta.10",
                    "status": "affected",
                    "version": "1.7.0-beta.0",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "1.7.0-beta.10",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "disclosure@vulncheck.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "@better-auth/stripe versions \u003e= 1.4.11 and \u003c 1.6.21, and \u003e= 1.7.0-beta.0 and \u003c 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller\u0027s active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization\u0027s billing details including payment methods, invoices, and subscription state."
          },
          {
            "lang": "es",
            "value": "Las versiones de @better-auth/stripe \u003e= 1.4.11 y anterior a 1.6.21, y \u003e= 1.7.0-beta.0 y anterior a 1.7.0-beta.10, contienen un bypass de autorizaci\u00f3n en las acciones de suscripci\u00f3n de la organizaci\u00f3n. El middleware valida el ID de la organizaci\u00f3n tomado de la cadena de consulta de la solicitud contra el callback authorizeReference, pero el gestor lee el ID de la organizaci\u00f3n solo del cuerpo de la solicitud y recurre a la organizaci\u00f3n activa del llamante de su sesi\u00f3n. Cuando estos difieren, un miembro autenticado de m\u00faltiples organizaciones puede realizar acciones de suscripci\u00f3n (cancelar, cambiar plan, restaurar, acceso al portal de facturaci\u00f3n) contra una organizaci\u00f3n a la que pertenecen pero que no deber\u00edan gestionar, y puede acceder a los detalles de facturaci\u00f3n de otra organizaci\u00f3n incluyendo m\u00e9todos de pago, facturas y estado de la suscripci\u00f3n."
          }
        ],
        "id": "CVE-2026-67329",
        "lastModified": "2026-10-23T23:10:00.157",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "disclosure@vulncheck.com",
              "type": "Secondary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "disclosure@vulncheck.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-67329",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-03T18:20:04.118634Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-01T13:17:03.523",
        "references": [
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-h3rm-78g3-j7cp"
          },
          {
            "source": "disclosure@vulncheck.com",
            "url": "https://www.vulncheck.com/advisories/better-auth-stripe-before-authorization-bypass-via-organization-subscription"
          }
        ],
        "sourceIdentifier": "disclosure@vulncheck.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "disclosure@vulncheck.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-67329",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-03T18:20:04.118634Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-03T18:20:12.924Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "packageURL": "pkg:npm/%40better-auth/stripe",
              "product": "stripe",
              "vendor": "better-auth",
              "versions": [
                {
                  "lessThan": "1.6.21",
                  "status": "affected",
                  "version": "1.4.11",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "1.6.21",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "packageURL": "pkg:npm/%40better-auth/stripe",
              "product": "stripe",
              "vendor": "better-auth",
              "versions": [
                {
                  "lessThan": "1.7.0-beta.10",
                  "status": "affected",
                  "version": "1.7.0-beta.0",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "1.7.0-beta.10",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*",
                      "versionEndExcluding": "1.6.21",
                      "versionStartIncluding": "1.4.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*",
                      "versionEndExcluding": "1.7.0-beta.10",
                      "versionStartIncluding": "1.7.0-beta.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "datePublic": "2026-06-26T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "@better-auth/stripe versions \u003e= 1.4.11 and \u003c 1.6.21, and \u003e= 1.7.0-beta.0 and \u003c 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller\u0027s active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization\u0027s billing details including payment methods, invoices, and subscription state."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "privilegesRequired": "LOW",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "HIGH"
              },
              "format": "CVSS"
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-08T15:24:07.826Z",
            "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
            "shortName": "VulnCheck"
          },
          "references": [
            {
              "name": "GitHub Security Advisory (GHSA-h3rm-78g3-j7cp)",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-h3rm-78g3-j7cp"
            },
            {
              "name": "VulnCheck Advisory: @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription",
              "tags": [
                "third-party-advisory"
              ],
              "url": "https://www.vulncheck.com/advisories/better-auth-stripe-before-authorization-bypass-via-organization-subscription"
            }
          ],
          "title": "@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription",
          "x_generator": {
            "engine": "vulncheck-endgame"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "assignerShortName": "VulnCheck",
        "cveId": "CVE-2026-67329",
        "datePublished": "2026-08-01T12:22:18.131Z",
        "dateReserved": "2026-07-29T13:07:47.015Z",
        "dateUpdated": "2026-10-08T15:24:07.826Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.