CVE-2026-67331: better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-01 · updated 2026-10-23
Weakness: CWE-639

Description

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

Affected products

better-auth scim: from 1.5.0 before 1.7.0-beta.4 — fixed in 1.7.0-beta.4

How to fix

Upgrade to a fixed version: better-auth scim 1.7.0-beta.4. Check the vendor advisory for mitigations.

References

https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4
https://www.vulncheck.com/advisories/better-auth-scim-before-beta-4-authorization-bypass
https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4

Get alerted when CVE-2026-67331 or the next vulnerability affects your stack