SellAuth review 2026: the December breach, and what its sellers are still waiting for

SellAuth answered the reviews itself, in public and under its own name. Two of those exchanges, three months apart, carry most of the story.

The vulnerability is real and it is as serious as SellAuth says. React2Shell, tracked as CVE-2025-55182 for React and CVE-2025-66478 for Next.js, is an unauthenticated remote code execution flaw in the React Server Components protocol. It scores 10 out of 10, and attackers used it to steal cryptocurrency across hundreds of hosts. SellAuth is right that it hit a great many companies, and that is not the question a seller needs answered.

Here is the same company three months later, replying to somebody who was still waiting.

December 24: reimbursements have already begun, finishing by early January. March 23: reimbursements have already begun, and the finishing date is gone. It is the same sentence in the same tense three months later, which is what a seller weighing up SellAuth has to sit with.

A third seller, writing in the same week as the first, adds that there is no contract behind any of it.

The first of those three sellers also says he was banned from SellAuth’s Discord for protesting about the missing money. That is his account of it, and nobody outside the server can check what happened there.

Take the names out and this is a custody story. A hole in a widely used framework handed an attacker the ability to run code. Because merchant crypto balances were sitting on the platform, there was something there to take. Every affected seller then became an unsecured creditor of a company they have no contract with, waiting on a timetable they do not control.

Being non-custodial does not make a platform immune to a vulnerability like this one. It changes what is at risk when one lands. If buyers pay your own Stripe, PayPal or crypto wallet directly, a compromised storefront is an outage: expensive and infuriating, and your revenue was never in the blast radius, because there was no balance to drain. That is how ByteSell is built, and it is why the question of who holds the money is one to ask before something goes wrong rather than after.

SellAuth holds a 3.0 on Trustpilot across 114 reviews, and the shape of that average says more than the number does: 48% are five star and 46% are one star, with almost nothing in between. The complaints in the one-star half start six months before the breach and carry on after it.

The most recent of them is also the most credible, because it is a downgrade rather than a first impression. This seller had hosted their stores on SellAuth and had left a five-star review before.

Note the edit at the top of that one. The funds were released after the review went up. It took a public one-star to move a ticket that had been open for thirty days.

This is the number that decides whether SellAuth can host your business at all, and it lives in the comparison table rather than on the plan cards. "Downloadable Files" reads 100 files at 10 MB on the free plan, and 500 files at 100 MB on Business. On Scale, the $29.99 plan, it reads exactly the same as Business: 500 files at 100 MB.

So the largest file a SellAuth store can deliver is 100 MB, and paying three times as much does not raise it. For an ebook, a licence key or a preset pack that is irrelevant. For a game mod, a sample library, a video course or a Unity asset it is the entire decision. ByteSell allows 50 MB on its free plan, 10 GB on Pro and 25 GB on Business. Team seats work the same way: 2, 10 and 50 across SellAuth’s three plans, where ByteSell caps team members on none of them.

On headline price SellAuth wins. Three plans, none of them taking a cut of a sale, funded by the subscription instead.

• Base, $0 forever

  0% transaction fees, up to 50 products, 25+ payment methods, basic fraud protection, API access and embeds, on a SellAuth subdomain with SellAuth branding.

• Business, $9.99 a month

  Adds a custom domain and custom pages, 500 products, an affiliate system with 10 tiers and 500 affiliates, fraud shield with VPN, TOR and country blocking, custom email templates and SMTP, and the Checkout API.

• Scale, $29.99 a month

  Adds the Marble premium theme, 5,000 products, the reseller system and panel, feedback on any order with no minimum, and priority dispute resolution.

A custom domain at $9.99 undercuts ByteSell Pro at $29, and the fraud blocking sits on that same tier. On price alone SellAuth is cheaper and it is not close.

One oddity to clear up before paying: both paid plans print a monthly price and then, directly underneath, the words "One-time payment · no auto-renewal". The page never reconciles those two statements. Ask which one governs.

So the decision comes down to what you sell and how much you mind a balance. If every product you have fits under 100 MB, price is the constraint you feel most, and you are willing to empty the platform balance rather than let it build up, then SellAuth at $9.99 is a cheap way to run a shop and the reviews on the five-star half of that split were not written by nobody. If any of your products is larger than 100 MB, or you would rather your revenue never sat on a platform in the first place, neither of those is something you can configure your way around, and the answer is a store where the money keeps moving on its way to you. ByteSell costs nothing to start and 0% on every plan, files run to 10 GB on Pro, and buyers pay your own Stripe, PayPal or wallet, so there is no balance for the next vulnerability to find.