@better-auth/stripe versions >=1.4.11 and <1.6.21 contain an authorization bypass vulnerability in organization subscription actions. The middleware validates the organization ID from the request query string against an authorization callback, but the actual handler reads the organization ID from the request body or falls back to the user's active organization in session. When these IDs differ, an authenticated user who is a member of multiple organizations can perform subscription management actions (such as canceling, changing plans, restoring subscriptions, and accessing the billing portal) on organizations they belong to but should not manage. This also allows unauthorized access to sensitive billing information including payment methods, invoices, and subscription states.

An authenticated user with membership in multiple organizations can bypass intended authorization controls to manage subscriptions and access billing information of other organizations they belong to but should not have management rights for. This leads to unauthorized subscription modifications and exposure of sensitive billing data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user permissions to limit membership in multiple organizations or avoid using affected versions. Monitor for vendor updates regarding an official fix.