CVE-2026-67330 Details
Description
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).
A critical authorization bypass vulnerability has been identified in the Better Auth SCIM plugin, specifically in versions 1.4.0-beta.27 prior to 1.6.21 and 1.7.0-beta.0 prior to 1.7.0-beta.9. The vulnerability arises because SCIM token issuance failed to reject provider IDs that were already in use by existing SSO, SAML, OIDC, generic OAuth, or social account providers. This oversight allowed an authenticated user to generate a SCIM token with a provider ID that collided with an existing provider namespace. As a result, SCIM user routes would resolve account rows that the token had not provisioned, enabling unauthorized access to user accounts.
Users can upgrade to Better Auth SCIM versions 1.6.22 or 1.7.0-rc.0. If an immediate upgrade is not possible, configure the 'canGenerateToken' policy to reject provider IDs that match any account provider ID used by the application, including built-in, social, generic OAuth, SSO, SAML, and OIDC provider IDs. Also, restrict which users can generate SCIM tokens.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 1, 2026CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| better-auth/scim | >= 1.4.0-beta.27, <= 1.6.21 (semver) >= 1.7.0-beta.0, <= 1.7.0-beta.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |