The vulnerability resides in the generateUserStripe function of the Checkout Handler in mickasmt next-saas-stripe-starter 1.0.0. By manipulating the priceId input, an attacker can cause the function to produce incorrect or unintended Stripe accounts, leading to business logic errors that may affect billing, subscription charges, or financial transactions. The flaw is an unchecked parameter validation as outlined by CWE‑840.

The affected product is mickasmt next-saas-stripe-starter, version 1.0.0. This is a SaaS starter kit for integrating Stripe payment logic.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no current known exploit but still possible. The flaw can be exploited remotely by feeding a crafted priceId to the generateUserStripe endpoint, potentially leading to unauthorized account creation or pricing manipulation. The risk is moderate but could have financial impact if exploited.