Billing - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/billing/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 01 Aug 2026 13:54:34 +0000Authorization Bypass in @better-auth/stripehttps://feed.craftedsignal.io/briefs/2026-08-better-auth-stripe-auth-bypass/Sat, 01 Aug 2026 13:54:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-better-auth-stripe-auth-bypass/An authorization bypass vulnerability in @better-auth/stripe allows authenticated users to perform unauthorized subscription actions and access billing data of other organizations via ID parameter confusion.The @better-auth/stripe package contains an authorization bypass vulnerability (CVE-2026-67329) affecting versions 1.4.11 through 1.6.20 and specific 1.7.0 beta releases. The vulnerability arises from an inconsistency in how organization IDs are processed. The package middleware performs authorization checks by validating the organization ID provided in the request query string. However, the underlying handler retrieves the target organization ID directly from the request body, or defaults to the session-associated active organization. This discrepancy enables a user who is a member of multiple organizations to bypass authorization controls. By manipulating the request body or session context, a user can execute subscription operations - such as canceling plans, modifying billing, or accessing sensitive payment details - against organizations they are authorized to access as a member, but lack management permissions for. This vulnerability poses a significant risk to multi-tenant SaaS environments using the library for billing integration.

Impact

Successful exploitation allows authenticated users to access billing details, including payment methods, invoices, and subscription states for organizations they do not manage. Furthermore, attackers can perform unauthorized administrative subscription actions, such as plan changes or account cancellations, resulting in potential service disruption and financial data exposure.

Recommendation

  1. Upgrade @better-auth/stripe to version 1.6.21 or 1.7.0-beta.10 or later immediately.
  2. Review application logs for discrepancies between query parameter organization IDs and the organization IDs processed in request bodies during billing-related API calls.
  3. Implement strict server-side validation that enforces a match between the authenticated user's session organization context and the organization identifier in the request body, regardless of query string parameters.
]]>highadvisoryauthorization-bypassweb-vulnerabilitybilling