CVE-2026-67329: @better-auth/stripe Auth Bypass Vulnerability

CVE-2026-67329 Overview

CVE-2026-67329 is an authorization bypass vulnerability in the @better-auth/stripe plugin, which integrates Stripe billing with the Better Auth framework. The flaw affects versions >= 1.4.11 and < 1.6.21, as well as pre-release versions >= 1.7.0-beta.0 and < 1.7.0-beta.10. The middleware validates the organization ID from the request query string, while the handler reads the organization ID from the request body. This inconsistency allows an authenticated member of multiple organizations to perform subscription actions against organizations they should not manage. Affected actions include cancelling subscriptions, changing plans, restoring subscriptions, and accessing the billing portal. The issue is tracked as CWE-639, Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated users can manipulate billing state and access payment methods, invoices, and subscription details belonging to other organizations they are members of.

Affected Products

@better-auth/stripe versions >= 1.4.11 and < 1.6.21
@better-auth/stripe versions >= 1.7.0-beta.0 and < 1.7.0-beta.10
Applications using Better Auth organization plugin with Stripe subscriptions

Discovery Timeline

2026-08-01 - CVE-2026-67329 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67329

Vulnerability Analysis

The @better-auth/stripe plugin exposes subscription actions such as cancel, plan change, restore, and billing portal access. The plugin's middleware enforces authorization by extracting the organization identifier from the request query string and passing it to the authorizeReference callback. The downstream handler, however, does not use the same source of truth. It reads the organization ID from the request body, and if that value is missing it falls back to the caller's active organization from the session. When the query string identifier differs from the body identifier, the authorization check runs against one organization while the mutation executes against another.

An authenticated user who belongs to more than one organization can exploit this desynchronization. They pass an organization they are permitted to manage in the query string to satisfy authorizeReference, then supply a different organization identifier in the request body. The handler acts on the second organization. This exposes billing details including payment methods, invoices, and subscription state, and allows destructive changes to subscriptions across tenant boundaries.

Root Cause

The root cause is inconsistent parameter sourcing between the authorization layer and the business logic. The middleware and handler read the same logical value from two different request locations, producing a Time-of-Check to Time-of-Use style logic gap classified as [CWE-639].

Attack Vector

Exploitation requires network access to the application, an authenticated session, and membership in at least two organizations. The attacker sends a request to a subscription endpoint with one organization ID in the query string and a different organization ID in the JSON body. The middleware authorizes the query string value while the handler operates on the body value. No user interaction from other tenants is required.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-h3rm-78g3-j7cp and the VulnCheck Advisory for further technical detail.

Detection Methods for CVE-2026-67329

Indicators of Compromise

Requests to Better Auth Stripe subscription endpoints where the referenceId or organization ID in the query string does not match the value in the JSON body.
Stripe webhook events showing subscription cancellations, plan changes, or restores performed by users who are not administrators of the target organization.
Access to /billing-portal or subscription list endpoints returning data for organization IDs the requesting session does not have an active session context for.

Detection Strategies

Instrument the @better-auth/stripe middleware to log both the query string organization ID and the body organization ID, and alert whenever the two values diverge.
Correlate application audit logs with Stripe API activity to identify subscription actions initiated by non-admin members.
Review historical logs for authenticated multi-tenant users triggering subscription mutations in unexpected organizations.

Monitoring Recommendations

Forward Better Auth and Stripe activity logs to a centralized SIEM or data lake for cross-source correlation.
Baseline expected subscription-modification volume per organization and alert on outliers.
Monitor Stripe billing portal session creation calls and validate the invoking user role against the target organization.

How to Mitigate CVE-2026-67329

Immediate Actions Required

Upgrade @better-auth/stripe to version 1.6.21 or later, or to 1.7.0-beta.10 or later on the beta channel.
Audit Stripe subscription activity for the affected version window and identify unauthorized cross-organization changes.
Rotate any billing portal session links generated during the vulnerable window and invalidate cached invoice URLs.

Patch Information

The maintainers released fixed versions 1.6.21 and 1.7.0-beta.10 that align the organization ID source between the middleware and the handler. Refer to the GitHub Security Advisory GHSA-h3rm-78g3-j7cp for release notes and upgrade guidance.

Workarounds

If an immediate upgrade is not possible, add a server-side guard that rejects any subscription request where the organization ID in the body does not match the organization ID in the query string.
Restrict multi-organization membership for accounts that manage billing until the patch is applied.
Temporarily disable the self-service billing portal and route subscription changes through an administrator-reviewed workflow.

bash

# Upgrade to a patched release
npm install @better-auth/stripe@^1.6.21

# Or on the beta channel
npm install @better-auth/stripe@1.7.0-beta.10