---
id: "CVE-2026-57562"
kind: "vulnerability"
aliases: ["CVE-2026-57562"]
title: "Readest: Stripe check endpoint grants paid plans without verifying session owner"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "readest", "self-hosted", "stripe"]
not_affected_if: ["no-stripe-billing", "version-0.11.10-or-later"]
published_at: "2026-11-04T22:18:06+00:00"
first_seen_at: "2026-11-04T23:08:49+00:00"
updated_at: "2026-11-04T23:10:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57562", "first_seen_at": "2026-11-04T23:08:49+00:00"}]
exploit_sources: []
---

# Readest: Stripe check endpoint grants paid plans without verifying session owner

Readest, an ebook reader, has an API endpoint that grants a paid subscription to the calling account using a Stripe Checkout Session ID without checking that the session belongs to that account. An authenticated free user can reuse a paid session ID to upgrade other accounts without paying.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Readest version in use; versions before `0.11.10` are affected.
- Look for `apps/readest-app/src/app/api/stripe/check/route.ts` in the deployed source and confirm whether it verifies `session.metadata.userId`.

## Fix

- Readest: move to `0.11.10` or later.

## Timeline

- 2026-11-04T23:08:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57562

## Documents

- [advisory] Vendor advisory: github.com https://github.com/readest/readest/security/advisories/GHSA-pv88-3727-j7v8
- [fix] Patch: github.com https://github.com/readest/readest/commit/495783d04516d05b2eb10f8f8bad297d436b36de
- [fix] Release notes: github.com https://github.com/readest/readest/releases/tag/v0.11.10

## From the sources

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller's user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user's own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_