CVE-2026-67329 better-auth CVE debrief

Who should care

Users of @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, who manage multiple organizations and rely on the library for subscription actions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that subscription actions are properly authorized and monitored to prevent unauthorized access to billing details and subscription states.

Technical summary

The @better-auth/stripe library contains an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. This vulnerability allows an authenticated member of multiple organizations to perform subscription actions against an organization they belong to but should not manage, potentially leading to unauthorized access to billing details, including payment methods, invoices, and subscription state. Users of affected versions should verify their organization's membership and authorization for these actions, restrict access based on organization membership and roles, and monitor for suspicious subscription actions. Evidence of this vulnerability includes the CVE record and affected version details.

Defensive priority

Authenticated members of multiple organizations may be able to bypass authorization for subscription actions against an organization they belong to but should not manage.

Recommended defensive actions

• Verify the organization's membership and authorization for subscription actions.
• Restrict access to subscription actions based on organization membership and roles.
• Monitor for suspicious subscription actions across multiple organizations.
• Implement additional authorization checks for subscription actions.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record indicates an authorization bypass in @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10. The vulnerability allows an authenticated member of multiple organizations to perform subscription actions against an organization they belong to but should not manage. Evidence of this vulnerability includes the CVE record and affected version details. Defenders should verify affected product deployments, review official advisories, and plan for vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.