GHSA-q2x3-gch7-6g53

The better-auth apiKey plugin's own HTTP endpoint POST /api/auth/api-key/create is enabled. It accepts client-supplied metadata, and Dokploy trusts metadata.organizationId to pick the organization context for the key. The tRPC wrapper user.createApiKey checks that the caller is a member of that organization; the native endpoint does not. Any authenticated user can mint a key bound to an organization they do not belong to. validateRequest then builds a session with activeOrganizationId set to that organization and role defaulting to "member" even though no membership row exists. Every protectedProcedure that scopes data only by ctx.session.activeOrganizationId then serves the foreign organization's data.

• Attacker has any account on the instance (here: a plain member of organization B only).
• Attacker knows the victim organization id (org ids are not secret in the sense of being access-controlled; how hard they are to obtain was not assessed).