CVE-2026-67331

HIGH 8.3

better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass

CVSS Score

8.3

EPSS Score

0.0%

EPSS Percentile

0th

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

CWE	CWE-639
Vendor	better-auth
Product	scim
Published	Aug 1, 2026

Stay Ahead of the Next One

Get instant alerts for better-auth scim

Be the first to know when new high vulnerabilities affecting better-auth scim are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Affected Versions

better-auth / scim

1.5.0 < 1.7.0-beta.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4 vulncheck.com: https://www.vulncheck.com/advisories/better-auth-scim-before-beta-4-authorization-bypass

Credits

🔍 Jvr2022