CVE-2026-67329

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67329", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-29T13:07:47.015Z", "datePublished": "2026-08-01T12:22:18.131Z", "dateUpdated": "2026-10-08T15:24:07.826Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:24:07.826Z"}, "datePublic": "2026-06-26T00:00:00.000Z", "title": "@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription", "descriptions": [{"lang": "en", "value": "@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "affected": [{"vendor": "better-auth", "product": "stripe", "defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/stripe", "versions": [{"version": "1.4.11", "status": "affected", "versionType": "semver", "lessThan": "1.6.21"}, {"version": "1.6.21", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "better-auth", "product": "stripe", "defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/stripe", "versions": [{"version": "1.7.0-beta.0", "status": "affected", "versionType": "semver", "lessThan": "1.7.0-beta.10"}, {"version": "1.7.0-beta.10", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "1.4.11", "versionEndExcluding": "1.6.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*", "versionStartIncluding": "1.7.0-beta.0", "versionEndExcluding": "1.7.0-beta.10"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-h3rm-78g3-j7cp", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-h3rm-78g3-j7cp)"}, {"name": "VulnCheck Advisory: @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/better-auth-stripe-before-authorization-bypass-via-organization-subscription"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T18:20:04.118634Z", "id": "CVE-2026-67329", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T18:23:06.596Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67329", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T18:20:04.118634Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T18:20:12.924Z"}}], "cna": {"title": "@better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription", "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "better-auth", "product": "stripe", "versions": [{"status": "affected", "version": "1.4.11", "lessThan": "1.6.21", "versionType": "semver"}, {"status": "unaffected", "version": "1.6.21", "versionType": "semver"}], "packageURL": "pkg:npm/%40better-auth/stripe", "defaultStatus": "unaffected"}, {"vendor": "better-auth", "product": "stripe", "versions": [{"status": "affected", "version": "1.7.0-beta.0", "lessThan": "1.7.0-beta.10", "versionType": "semver"}, {"status": "unaffected", "version": "1.7.0-beta.10", "versionType": "semver"}], "packageURL": "pkg:npm/%40better-auth/stripe", "defaultStatus": "unaffected"}], "datePublic": "2026-06-26T00:00:00.000Z", "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-h3rm-78g3-j7cp", "name": "GitHub Security Advisory (GHSA-h3rm-78g3-j7cp)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/better-auth-stripe-before-authorization-bypass-via-organization-subscription", "name": "VulnCheck Advisory: @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass Through User-Controlled Key"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "1.6.21", "versionStartIncluding": "1.4.11"}, {"criteria": "cpe:2.3:a:better-auth:better_auth:*:*:*:*:*:node.js:*:*", "vulnerable": true, "versionEndExcluding": "1.7.0-beta.10", "versionStartIncluding": "1.7.0-beta.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:24:07.826Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67329", "state": "PUBLISHED", "dateUpdated": "2026-10-08T15:24:07.826Z", "dateReserved": "2026-07-29T13:07:47.015Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-01T12:22:18.131Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/stripe", "product": "stripe", "vendor": "better-auth", "versions": [{"lessThan": "1.6.21", "status": "affected", "version": "1.4.11", "versionType": "semver"}, {"status": "unaffected", "version": "1.6.21", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/stripe", "product": "stripe", "vendor": "better-auth", "versions": [{"lessThan": "1.7.0-beta.10", "status": "affected", "version": "1.7.0-beta.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.7.0-beta.10", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions (cancel, change plan, restore, billing portal access) against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state."}, {"lang": "es", "value": "Las versiones de @better-auth/stripe >= 1.4.11 y anterior a 1.6.21, y >= 1.7.0-beta.0 y anterior a 1.7.0-beta.10, contienen un bypass de autorizaci\u00f3n en las acciones de suscripci\u00f3n de la organizaci\u00f3n. El middleware valida el ID de la organizaci\u00f3n tomado de la cadena de consulta de la solicitud contra el callback authorizeReference, pero el gestor lee el ID de la organizaci\u00f3n solo del cuerpo de la solicitud y recurre a la organizaci\u00f3n activa del llamante de su sesi\u00f3n. Cuando estos difieren, un miembro autenticado de m\u00faltiples organizaciones puede realizar acciones de suscripci\u00f3n (cancelar, cambiar plan, restaurar, acceso al portal de facturaci\u00f3n) contra una organizaci\u00f3n a la que pertenecen pero que no deber\u00edan gestionar, y puede acceder a los detalles de facturaci\u00f3n de otra organizaci\u00f3n incluyendo m\u00e9todos de pago, facturas y estado de la suscripci\u00f3n."}], "id": "CVE-2026-67329", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67329", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T18:20:04.118634Z", "version": "2.0.3"}}]}, "published": "2026-08-01T13:17:03.523", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-h3rm-78g3-j7cp"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/better-auth-stripe-before-authorization-bypass-via-organization-subscription"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.4.11,1.6.21)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.6.21"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "stripe", "source": "cna", "vendor": "better-auth"}, "product": "stripe", "vendor": "better-auth"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.7.0-beta.0,1.7.0-beta.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.7.0-beta.10"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "stripe", "source": "cna", "vendor": "better-auth"}, "product": "stripe", "vendor": "better-auth"}], "created": "2026-08-02T20:31:32.363801+00:00", "updated": "2026-08-03T09:45:04.452613+00:00", "vendors": ["better-auth", "better-auth$PRODUCT$stripe"]}