CVE-2026-67329: better-auth Stripe authorization bypass in organization subscription actions

CVE-2026-67329 · Severity: high · CVSS 7.1 · Published 2026-08-01

The @better-auth/stripe plugin, which manages subscription billing for organizations, contains a flaw that allows an authenticated user who belongs to multiple organizations to perform billing actions (cancel subscriptions, change plans, restore service, or access billing portals) on organizations they should not manage. An attacker with membership in multiple organizations can view sensitive billing details including payment methods, invoices, and subscription status for other organizations they belong to.

Vendors: Better-Auth.

Quick answers

Is CVE-2026-67329 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-67329 being exploited in the wild.
How severe is CVE-2026-67329?
High severity, with a CVSS score of 7.1, published 1 August 2026.
Which products and versions are affected?
Better-Auth Stripe >=1.4.11, <1.6.21; >=1.7.0-beta.0, <1.7.0-beta.10.
Is there a fix for CVE-2026-67329?
A patch was published on 2026-06-25: Fix committed; patches released as 1.6.21 and 1.7.0-beta.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67329 attacked?
It is attacked over the network.
Am I affected by CVE-2026-67329?
Check whether you run Better-Auth Stripe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrect authorization check (CWE-863) and authorization bypass through user-controlled keys (CWE-639) in the organization subscription action handlers. The plugin validates the organization ID from the request query string in middleware, but the actual action handler reads the organization ID only from the request body and falls back to the user's active organization from session when the body is empty. When an authenticated user sends a request with a managed organization in the query string but no ID in the body, the middleware approves the queried organization while the handler operates on the active organization, causing a mismatch. The target organization is always one the user belongs to, but the user may not have billing management rights. Attack requires authentication, valid membership in multiple organizations, and the target application to have both subscription.enabled and organization.enabled settings active. Patches are available in @better-auth/stripe 1.6.21 and 1.7.0-beta.10 or later.

Affected products

  • better-auth Stripe >=1.4.11, <1.6.21; >=1.7.0-beta.0, <1.7.0-beta.10

Identifiers

  • CVE-2026-67329
  • GHSA-h3rm-78g3-j7cp

Timeline

  • 2026-07-24: disclosed
  • 2026-06-25: patched: Fix committed; patches released as 1.6.21 and 1.7.0-beta.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.