Read the docs
TI-2026-85219 Aliases CVE-2026-57562

Authorization bypass in Readest lets users hijack paid subscriptions

Priority MEDIUM 62CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Readest versions before 0.11.10 are affected. The POST /api/stripe/check endpoint grants a paid plan for a client-supplied Checkout Session without checking that the session belongs to the caller, an authorization bypass through a user-controlled key (CWE-639). An authenticated user with low privileges can reuse a paid session identifier to upgrade other accounts without payment.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe Checkout Session, and granted the paid plan to the authenticated caller without verifying session.metadata.userId. The createOrUpdateSubscription path then updated the plans row keyed by the caller's user identifier rather than the Checkout Session owner. Any authenticated free user with a paid active Checkout Session identifier, including one from the user's own single legitimate purchase, could replay that identifier to upgrade additional accounts without payment. This issue is fixed in version 0.11.10.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00426 37th percentileScored 2026-11-07
Fix Fixed readest (readest): 0.11.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
readestreadestbefore 0.11.100.11.10Patch availableCNA
  • readest Vendorreadest Affected before 0.11.10 Fixed in 0.11.10 Patch available CNA

Remediation

Upgrade Readest to version 0.11.10.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA readest (readest) Fixed in 0.11.10

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-57562
  2. 2026-11-05 CISA SSVC decision points changed

References

Other 4

  • TI-2026-85221 Server-side request forgery in Readest OPDS proxy CVSS 3.1CRITICAL 9.3
  • TI-2026-85222 Path traversal in Readest Tauri commands allows arbitrary file access CVSS 3.1HIGH 8.6
  • TI-2026-85220 Path traversal in Readest upload overwrites other users' books CVSS 3.1MEDIUM 6.5
  • TI-2026-56980 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences