The @better-auth/stripe package contains an authorization bypass vulnerability that enables low-privileged users to perform unauthorized subscription actions.

This vulnerability is an authorization bypass (CWE-639) occurring due to insufficient validation of user-controlled keys. The CVSS vector (PR:L) indicates that an attacker must possess low-level authentication to exploit this flaw.

The vulnerability carries a CVSS score of 7.1, reflecting a high risk of unauthorized data integrity compromise. Successful exploitation allows an authenticated attacker to manipulate subscription states, potentially leading to unauthorized service access or financial discrepancies within the application.

Immediate Action: Update the @better-auth/stripe package to version 1.6.21 or 1.7.0-beta.10 to incorporate the necessary security fixes.

Proactive Monitoring: Review application logs for suspicious patterns related to subscription modifications or unusual API calls originating from low-privileged user accounts.

Compensating Controls: Implement strict server-side validation for all subscription-related requests to ensure that users can only modify resources they are explicitly authorized to manage.

Public Exploit Available: Unknown.

Given the potential for unauthorized subscription manipulation, organizations utilizing the affected versions of @better-auth/stripe should prioritize upgrading to the patched releases. Immediate action is required to restore proper authorization controls and prevent potential exploitation by malicious actors with low-level access.