1vulnerability
- Critical0 (0.0%)
- High1 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
better-auth-stripe
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 1HighAffects 2 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting better-auth-stripe, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-h3rm-78g3-j7cp | High | @better-auth/stripe: cross-organization billing tampering in organization subscription actions### Am I affected? You are affected if all of these are true: - You use `@better-auth/stripe` from version 1.4.11 up to a patched version below. This covers the stable line through 1.6.20 and every 1.7.0 beta through 1.7.0-beta.9. - The Stripe plugin has subscriptions turned on (`subscription.enabled: true`). - Organization subscriptions are turned on (`organization.enabled: true`) and you have set an `authorizeReference` callback. - A user can join more than one org. So a user can be a member of an org whose billing they should not manage. You are not affected if you only use user subscrip |
| GitHub (opens in a new tab) |
- GHSA-h3rm-78g3-j7cpHigh@better-auth/stripe: cross-organization billing tampering in organization subscription actions
>= 1.4.11, < 1.6.21>= 1.7.0-beta.0, < 1.7.0-beta.10
### Am I affected? You are affected if all of these are true: - You use `@better-auth/stripe` from version 1.4.11 up to a patched version below. This covers the stable line through 1.6.20 and every 1.7.0 beta through 1.7.0-beta.9. - The Stripe plugin has subscriptions turned on (`subscription.enabled: true`). - Organization subscriptions are turned on (`organization.enabled: true`) and you have set an `authorizeReference` callback. - A user can join more than one org. So a user can be a member of an org whose billing they should not manage. You are not affected if you only use user subscrip
CVE: CVE-2026-67329