p PatchFirst

CVE-2026-67331

CVE-2026-67331 · better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass

This page contains facts from public vulnerability sources. Check the original advisory before updating.

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

CVSS 8.7 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • scim

    Versions
    • ≥ 1.5.0, < 1.7.0-beta.4: Affected (semver)
    • 1.7.0-beta.4: Not affected (semver)

    Update to 1.7.0-beta.4

  • @better-auth/scim npm

    Affected ranges
    • SEMVER: ≥ 1.5.0, < 1.7.0-beta.4

    Update to 1.7.0-beta.4

Original sources

Check your server →