CVE-2026-57562 · Package
NO FIX YET · SEE WHAT TO DO
Readest, an ebook reader, has an API endpoint that grants a paid subscription to the calling account using a Stripe Checkout Session ID without checking that the session belongs to that account. An authenticated free user can reuse a paid session ID to upgrade other accounts without paying.
first public Oct 15, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only deployments of Readest before 0.11.10 that run the Stripe check route and let users sign up for paid plans are exposed. The flaw needs a logged-in account, so deployments with no public sign-up or no Stripe billing are lower risk. unknown beyond that.
Not affected if no-stripe-billing, version-0.11.10-or-later
Who cares readest, self-hosted, stripe
0.11.10 are affected.apps/readest-app/src/app/api/stripe/check/route.ts in the deployed source and confirm whether it verifies session.metadata.userId.0.11.10 or later.Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller's user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user's own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.