CVE-2026-67329
1 advisory.
npm/@better-auth/stripe CVE-2026-67329: high 7.1, EPSS 0.31%
@better-auth/stripe: cross-organization billing tampering in organization subscription actions
Action: Upgrade @better-auth/stripe to 1.6.21 or later.
npm i @better-auth/stripe@1.6.21npm i @better-auth/stripe@1.7.0-beta.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.4.11 | 1.6.21 | - |
| 1.7.0-beta.0 | 1.7.0-beta.10 | - |
Fixed versions
| 1.6.21 | 1.7.0-beta.10 |
Sources
- osv: GHSA-h3rm-78g3-j7cp
- https://github.com/better-auth/better-auth/security/advisories/GHSA-h3rm-78g3-j7cp
- https://github.com/better-auth/better-auth/commit/29fbcb573261242d8a05b131a9d39c9ae4352b06
- https://github.com/better-auth/better-auth
- https://github.com/better-auth/better-auth/releases/tag/v1.6.21
- https://github.com/better-auth/better-auth/releases/tag/v1.7.0-beta.10
CVE-2026-67329 · published · modified · JSON