CVE-2026-57562

The Readest ebook reader, prior to version 0.11.10 , is vulnerable to a subscription/entitlement hijack via CWE-639 . The POST /api/stripe/check endpoint in apps/readest-app/src/app/api/stripe/check/route.ts accepts a client-controlled sessionId and grants a paid plan to the authenticated caller ...

PT-2026-137203

Name of the Vulnerable Software and Affected Versions Readest versions prior to 0.11.10 Description An issue exists where the application grants paid plans to authenticated users without properly verifying the session ownership. Specifically, the endpoint "/api/stripe/check" accepts a...