CVE-2026-57562: Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller's user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user's own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Readestto a version that resolves this vulnerability.Fixed in 0.11.10
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated free user can exploit it if they know a paid, active Stripe Checkout Session identifier. The identifier may come from the user's own legitimate purchase and can be replayed to upgrade additional accounts.
What conditions are required for exploitation?
The affected instance must be running a version prior to 0.11.10, and the attacker must be able to authenticate as a free user. They also need a paid active Checkout Session identifier; no user interaction is required.
Are users affected by default?
Affected versions expose the vulnerable behavior through POST /api/stripe/check. The issue occurs because the endpoint accepts a client-provided sessionId and does not verify that the Checkout Session metadata userId matches the authenticated caller.
How can I determine whether an upgrade may have been unauthorized?
Review paid-plan assignments and subscription updates for accounts whose user identifier does not match the userId in the associated Stripe Checkout Session metadata. Reuse of the same paid active Checkout Session identifier across multiple accounts is an indicator of abuse.
What is the available remediation?
Upgrade Readest to version 0.11.10, which fixes the missing verification between the authenticated caller and the Checkout Session owner.