Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

better-auth/scim can enable account takeover

CVE-2026-67330 · published 3 months ago
Summary

Versions of the better-auth/scim plugin from 1.4.0‑beta.27 up to 1.6.21 and from 1.7.0‑beta.0 up to 1.7.0‑beta.9 allow a logged‑in user to create a special token that mimics an existing identity provider. This lets the user view, change or delete other users' accounts and sessions. Upgrade to version 1.6.22 or 1.7.0‑beta.10 (or later) to close the gap.

What to do
  • Update better-auth @better-auth/scim to version 1.6.22.
  • Update better-auth @better-auth/scim to version 1.7.0-beta.10.
  • Update better-auth scim to version * or later.
Affected software
Ecosystem VendorProductAffected versions
– better-auth scim < *
npm better-auth @better-auth/scim >= 1.4.0-beta.27, < 1.6.22
>= 1.7.0-beta.0, < 1.7.0-beta.10
Fix: upgrade to 1.6.22
Original advisory text
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-639Authorization Bypass Through User-Controlled Key
CWE-862Missing Authorization
Timeline
Published1 Aug 2026
Updated7 Nov 2026
First seen1 Aug 2026
Sources
CVE-2026-67330 · NVD
CVE-2026-67330 · MITRE
GHSA-rjg6-39jm-rgg4 · OSV
Track software like this
Free during beta