CVE-2026-4547

mickasmt next-saas-stripe-starter Checkout generate-user-stripe.ts generateUserStripe logic error

View on CVE.org
Published Mar 22, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0. Affected is the function generateUserStripe of the file actions/generate-user-stripe.ts of the component Checkout Handler. The manipulation of the argument priceId leads to business logic errors. The attack may be initiated remotely.

Analysis

AI-generated

Technical impact

The vulnerability resides in the generateUserStripe function of the Checkout Handler in mickasmt next-saas-stripe-starter 1.0.0. By manipulating the priceId input, an attacker can cause the function to produce incorrect or unintended Stripe accounts, leading to business logic errors that may affect billing, subscription charges, or financial transactions. The flaw is an unchecked parameter validation as outlined by CWE‑840.

Affected Systems

The affected product is mickasmt next-saas-stripe-starter, version 1.0.0. This is a SaaS starter kit for integrating Stripe payment logic.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no current known exploit but still possible. The flaw can be exploited remotely by feeding a crafted priceId to the generateUserStripe endpoint, potentially leading to unauthorized account creation or pricing manipulation. The risk is moderate but could have financial impact if exploited.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update mickasmt next-saas-stripe-starter to a patched version if one is available.
  • If no patch exists, modify the generateUserStripe routine to validate the priceId against a whitelist of legitimate Stripe price identifiers before processing.
  • Log attempts to use invalid priceId values and alert administrators.

Generated by OpenCVE AI on March 22, 2026 at 14:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Mickasmt
Mickasmt next-saas-stripe-starter
Vendors & Products Mickasmt
Mickasmt next-saas-stripe-starter
Type Values Removed Values Added
Description A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0. Affected is the function generateUserStripe of the file actions/generate-user-stripe.ts of the component Checkout Handler. The manipulation of the argument priceId leads to business logic errors. The attack may be initiated remotely.
Title mickasmt next-saas-stripe-starter Checkout generate-user-stripe.ts generateUserStripe logic error
Weaknesses CWE-840
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Mar 23, 2026, 4:32 PM
Reserved
Mar 21, 2026, 4:48 PM

View source JSON

Updated
Mar 23, 2026, 4:32 PM

JSON

Status
Deferred
Published
Mar 22, 2026, 2:16 PM
Modified
Jun 17, 2026, 10:56 AM

View source JSON

No data.

Updated
Mar 25, 2026, 2:46 PM

JSON