Attack Chain

1. An attacker, possessing a valid user account, authenticates to an application using the vulnerable @better-auth/stripe library.
2. The attacker is a member of at least two organizations (e.g., Organization A and Organization B), where they are authorized to manage billing for Organization A but not Organization B.
3. The attacker intends to perform an unauthorized subscription action (e.g., cancel a subscription) on Organization B.
4. The attacker crafts an HTTP request for a subscription action, including Organization A's ID in the request's query string (e.g., ?orgId=OrgA_ID).
5. The crafted request deliberately omits Organization B's ID from the request body or sends an empty body.
6. The @better-auth/stripe middleware processes the request, validating the OrgA_ID from the query string via the authorizeReference callback, thereby approving the request.
7. The request proceeds to the route handler. Since no organization ID is found in the request body, the handler defaults to using the attacker's session.activeOrganizationId, which is set to OrgB_ID.
8. The subscription action is then executed against Organization B, allowing the attacker to manipulate its billing or access its sensitive billing details without proper authorization.

Impact

Successful exploitation of this vulnerability enables an authenticated user to perform unauthorized subscription actions, including cancellation, plan changes, restoration, or access to the billing portal, on organizations they are a member of but lack specific billing management authorization for. This directly impacts the targeted organizations, potentially leading to financial losses due to unwarranted subscription changes or cancellations. Furthermore, accessing another organization's billing portal exposes sensitive financial data, such as payment methods, invoices, and subscription states, to the unauthorized user. The scope of impact is limited to organizations that the attacker's user account is a member of.

Recommendation

• Upgrade to @better-auth/stripe@1.6.21 or later (for stable versions) or @better-auth/stripe@1.7.0-beta.10 or later (for beta versions) to patch the vulnerability.
• If immediate upgrade is not possible, implement the recommended workaround by modifying the authorizeReference callback to ensure the referenceId matches session.activeOrganizationId, returning false otherwise.
• Configure web server logs to capture full HTTP request details, including query strings and request bodies, to aid in forensic analysis of suspicious activity.
• Review application-specific logs for instances where the authorizeReference callback approves an organization ID that differs from the session.activeOrganizationId during subscription actions, indicating a potential exploit attempt.