@better-auth/stripe versions >=1.4.11 <1.6.21 and >=1.7.0-beta.0 <1.7.0-beta.10 contain an authorization bypass in organization subscription actions. The middleware validates the organization ID from the request query string against the authorizeReference callback, but the handler reads the organization ID from the request body and falls back to the caller's active organization in their session. When these organization IDs differ, an authenticated user who is a member of multiple organizations can perform subscription-related actions on an organization they belong to but should not manage. This allows unauthorized access to billing details including payment methods, invoices, and subscription state.

An authenticated user who belongs to multiple organizations can bypass authorization controls to manage subscriptions and access billing information of organizations they should not have permission to manage. This can lead to unauthorized subscription cancellations, plan changes, restorations, billing portal access, and exposure of sensitive billing data such as payment methods and invoices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict membership to a single organization where possible or implement additional access controls to ensure organization IDs used in authorization and handling are consistent. Monitor for updates from the vendor regarding official patches or workarounds.