Executive brief
A vulnerability in the Stripe plugin for Better Auth allows users who belong to multiple organizations to perform billing actions on the wrong account. An attacker could cancel subscriptions, change plans, or view sensitive payment and invoice details for an organization they are a member of but do not have permission to manage. This could lead to unauthorized service disruptions and exposure of corporate financial information.
Technical details
An authorization bypass exists in @better-auth/stripe due to a discrepancy between how middleware and route handlers resolve organization IDs. The middleware validates permissions using an ID provided in the request query string, but the subsequent route handler defaults to the user's 'active' session organization ID if no ID is found in the request body. By providing a valid organization ID in the query string and leaving the body empty, a member of multiple organizations can bypass the 'authorizeReference' check to perform actions (cancel, change plan, restore, or open billing portal) against their active organization. This vulnerability is classified under CWE-639 and CWE-863. It has been patched in versions 1.6.21 and 1.7.0-beta.10.
Affected products
- better-auth @better-auth/stripe >= 1.4.11, < 1.6.21
- better-auth @better-auth/stripe >= 1.7.0-beta.0, < 1.7.0-beta.10
Timeline
- 2026-06-25: patched: Fix committed to repository
- 2026-06-26: disclosed: Initial advisory publication
- 2026-07-24: advisory: Last updated/reviewed on GitHub Advisory Database
References
- https://github.com/better-auth/better-auth/security/advisories/GHSA-h3rm-78g3-j7cp
- https://github.com/better-auth/better-auth/commit/29fbcb573261242d8a05b131a9d39c9ae4352b06
- https://github.com/better-auth/better-auth/releases/tag/v1.6.21
- https://github.com/better-auth/better-auth/releases/tag/v1.7.0-beta.10
- https://api.github.com/repos/better-auth/better-auth/security-advisories/GHSA-h3rm-78g3-j7cp