CVE-2026-4549 Details
Description
A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult.
A vulnerability allowing authorization bypass has been identified in mickasmt next-saas-stripe-starter version 1.0.0. The issue arises in the openCustomerPortal function within the actions/open-customer-portal.ts file, part of the Stripe API component. This vulnerability allows remote exploitation, although it is considered to have a high attack complexity.
The vulnerability can be addressed by modifying the openCustomerPortal function to verify that the userStripeId belongs to the authenticated user, rather than accepting it directly from the client. This can be done by looking up the user's Stripe customer ID in the database based on their authenticated session.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 22, 2026CISA-ADP
Assessed Mar 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/?ctiid.352376 | [email protected] | Content Wall |
| https://vuldb.com/?id.352376 | [email protected] | AdvisoryTechnical Description |
| https://vuldb.com/?submit.774806 | [email protected] | ExploitTechnical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mickasmt next-saas-stripe-starter | All versions |
CPE
Remediation
| |
| Stripe API | 1.0.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 22, 2026 | New CVE Received | [email protected] |