{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/@better-auth/stripe--1.4.11--1.6.21/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@better-auth/stripe (\u003e= 1.4.11, \u003c 1.6.21)","@better-auth/stripe (\u003e= 1.7.0-beta.0, \u003c 1.7.0-beta.10)"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","web-application","supply-chain","application-library"],"_cs_type":"advisory","_cs_vendors":["better-auth"],"content_html":"\u003cp\u003eA high-severity authorization bypass vulnerability exists in the \u003ccode\u003e@better-auth/stripe\u003c/code\u003e library, specifically affecting versions 1.4.11 through 1.6.20 (stable) and 1.7.0-beta.0 through 1.7.0-beta.9 (beta). This flaw allows authenticated users to perform unauthorized subscription actions, such as canceling, changing plans, restoring subscriptions, or accessing the billing portal, for organizations they are a member of but not explicitly authorized to manage. The vulnerability stems from an inconsistency in how organization IDs are handled between the library's middleware and its route handler. The middleware, responsible for authorization, approves an organization ID provided in the request query string, while the route handler, which executes the action, defaults to using the active organization ID from the user's session if no ID is present in the request body. This discrepancy enables an attacker to bypass authorization checks and manipulate billing for an unintended organization, potentially leading to financial damage and sensitive data exposure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker, possessing a valid user account, authenticates to an application using the vulnerable \u003ccode\u003e@better-auth/stripe\u003c/code\u003e library.\u003c/li\u003e\n\u003cli\u003eThe attacker is a member of at least two organizations (e.g., Organization A and Organization B), where they are authorized to manage billing for Organization A but not Organization B.\u003c/li\u003e\n\u003cli\u003eThe attacker intends to perform an unauthorized subscription action (e.g., cancel a subscription) on Organization B.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP request for a subscription action, including Organization A's ID in the request's query string (e.g., \u003ccode\u003e?orgId=OrgA_ID\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe crafted request deliberately omits Organization B's ID from the request body or sends an empty body.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e@better-auth/stripe\u003c/code\u003e middleware processes the request, validating the \u003ccode\u003eOrgA_ID\u003c/code\u003e from the query string via the \u003ccode\u003eauthorizeReference\u003c/code\u003e callback, thereby approving the request.\u003c/li\u003e\n\u003cli\u003eThe request proceeds to the route handler. Since no organization ID is found in the request body, the handler defaults to using the attacker's \u003ccode\u003esession.activeOrganizationId\u003c/code\u003e, which is set to \u003ccode\u003eOrgB_ID\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe subscription action is then executed against Organization B, allowing the attacker to manipulate its billing or access its sensitive billing details without proper authorization.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability enables an authenticated user to perform unauthorized subscription actions, including cancellation, plan changes, restoration, or access to the billing portal, on organizations they are a member of but lack specific billing management authorization for. This directly impacts the targeted organizations, potentially leading to financial losses due to unwarranted subscription changes or cancellations. Furthermore, accessing another organization's billing portal exposes sensitive financial data, such as payment methods, invoices, and subscription states, to the unauthorized user. The scope of impact is limited to organizations that the attacker's user account is a member of.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to \u003ccode\u003e@better-auth/stripe@1.6.21\u003c/code\u003e or later (for stable versions) or \u003ccode\u003e@better-auth/stripe@1.7.0-beta.10\u003c/code\u003e or later (for beta versions) to patch the vulnerability.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, implement the recommended workaround by modifying the \u003ccode\u003eauthorizeReference\u003c/code\u003e callback to ensure the \u003ccode\u003ereferenceId\u003c/code\u003e matches \u003ccode\u003esession.activeOrganizationId\u003c/code\u003e, returning \u003ccode\u003efalse\u003c/code\u003e otherwise.\u003c/li\u003e\n\u003cli\u003eConfigure web server logs to capture full HTTP request details, including query strings and request bodies, to aid in forensic analysis of suspicious activity.\u003c/li\u003e\n\u003cli\u003eReview application-specific logs for instances where the \u003ccode\u003eauthorizeReference\u003c/code\u003e callback approves an organization ID that differs from the \u003ccode\u003esession.activeOrganizationId\u003c/code\u003e during subscription actions, indicating a potential exploit attempt.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T15:46:24Z","date_published":"2026-07-24T15:46:24Z","id":"https://feed.craftedsignal.io/briefs/2026-07-better-auth-stripe-tampering/","summary":"An authorization bypass vulnerability in the `@better-auth/stripe` library allows authenticated users to perform subscription actions (cancel, change plan, restore, open billing portal) against other organizations they are a member of, but not authorized to manage. This occurs due to inconsistent handling of organization IDs between the middleware, which approves the ID from the request query string, and the route handler, which acts on the active organization ID from the session or request body. This flaw enables users to access sensitive billing details and manipulate subscriptions for unintended organizations.","title":"Authorization Bypass in @better-auth/stripe Allows Cross-Organization Billing Tampering","url":"https://feed.craftedsignal.io/briefs/2026-07-better-auth-stripe-tampering/"}],"language":"en","title":"CraftedSignal Threat Feed - @Better-Auth/Stripe (\u003e= 1.4.11, \u003c 1.6.21)","version":"https://jsonfeed.org/version/1.1"}