CyberRota Analysis
AI-GeneratedThe vulnerability affects @better-auth/stripe versions between 1.4.11 and 1.6.21, as well as certain beta versions, allowing authenticated users to bypass authorization checks in organization subscription actions. This flaw enables users to manipulate subscriptions and access sensitive billing information for organizations they do not manage, posing a significant risk to data confidentiality and integrity. Organizations utilizing these affected versions should prioritize immediate remediation to prevent unauthorized access and potential financial exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state.