CVE-2026-67329

Name of the Vulnerable Software and Affected Versions @better-auth/stripe versions 1.4.11 through 1.6.20 @better-auth/stripe versions 1.7.0-beta.0 through 1.7.0-beta.9

Description An authorization bypass exists in organization subscription actions. The issue occurs because the middleware validates the organization ID from the request query string using the authorizeReference callback, while the route handler reads the organization ID only from the request body or falls back to the caller's active organization from their session. If these IDs differ, an authenticated member of multiple organizations can perform subscription actions—such as canceling, changing plans, restoring, or accessing the billing portal—against an organization they belong to but are not authorized to manage. This allows unauthorized access to billing details, including payment methods, invoices, and subscription states.

Recommendations Update @better-auth/stripe to version 1.6.21 or later. Update @better-auth/stripe to version 1.7.0-beta.10 or later. As a temporary workaround, configure the authorizeReference callback to return false if the requested ID does not match the caller's active organization ID.