HIGH

CVE-2026-67331

2026-08-01 CVSS v3.1

CVSS

8.3

Description

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

Weakness (CWE)

CWE-639 Authorization Bypass (IDOR)

EPSS Score

0.3%

Probability of exploitation in next 30 days

22.7th percentile

References

https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4 https://www.vulncheck.com/advisories/better-auth-scim-before-beta-4-authorization-bypass

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE