Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-67331 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CNA: [email protected]CVSS-B:8.3 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4	CISA-ADP	AdvisoryExploitRemedyVendor
https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4	[email protected]	AdvisoryExploitRemedyVendor
https://www.vulncheck.com/advisories/better-auth-scim-before-beta-4-authorization-bypass	[email protected]	AdvisoryRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-639	Authorization Bypass Through User-Controlled Key	[email protected]

Affected Products

Product	Versions
better-auth SCIM	>= 1.5.0, < 1.7.0-beta.4 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 1.7.0-beta.4moderate effort Workaround:low effort Set `providerOwnership: { enabled: true }` when registering the plugin, then run the schema update so the `scimProvider.userId` column exists (`npx auth generate` or `npx auth migrate`). New non-org providers are then owner-bound and non-owners are denied. Providers created before enabling ownership stay ownerless until recreated. Workaround:low effort Scope every SCIM provider to an organization by always passing `organizationId`. Organization providers enforce membership and role and are not exposed. Mitigation:low effort Restrict access to the SCIM management endpoints at the edge while non-org providers remain ownerless.

Product

Versions

better-auth SCIM

>= 1.5.0, < 1.7.0-beta.4 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 1.7.0-beta.4moderate effort
Workaround:low effort
Set `providerOwnership: { enabled: true }` when registering the plugin, then run the schema update so the `scimProvider.userId` column exists (`npx auth generate` or `npx auth migrate`). New non-org providers are then owner-bound and non-owners are denied. Providers created before enabling ownership stay ownerless until recreated.
Workaround:low effort
Scope every SCIM provider to an organization by always passing `organizationId`. Organization providers enforce membership and role and are not exposed.
Mitigation:low effort
Restrict access to the SCIM management endpoints at the edge while non-org providers remain ownerless.

Change History

2 change records found show changes

Date	Action	Recorded By
Aug 3, 2026	CVE Modified	CISA-ADP
Aug 1, 2026	New CVE Received	[email protected]