The vulnerability lies in the @better-auth/stripe middleware where the organization ID used for authorization checks is taken from the request query string. The actual handler, however, extracts the organization ID only from the request body and if none is present, defaults to the caller’s active organization stored in their session. This mismatch allows an authenticated user who belongs to multiple organizations to perform any subscription action—such as cancelling, changing plans, restoring, or accessing the billing portal—against an organization they are not permitted to manage. Consequently the user can also view another organization’s billing details, including payment methods, invoices, and subscription status. This is a classic example of an authorization bypass (CWE‑639).

The affected product is the better‑auth/stripe package. Versions 1.4.11 through 1.6.20 inclusive, and the pre‑release series 1.7.0‑beta.0 through 1.7.0‑beta.9 are vulnerable. Affected users of these releases operate in a shared multi‑organization context where at least one authenticated member can target the subscription endpoints of organizations they should not manage.

With a CVSS score of 7.1 the vulnerability is scored as Moderate‑High severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the user to be authenticated and have membership in both the target organization and the caller’s active organization. The exploit is remotely accessible via the subscription API endpoints, making it readily usable by anyone with valid credentials for a multi‑organization account. Based on the description, the likely attack vector is authentication‑based remote exploitation through the exposed subscription actions.