CVE-2026-67331

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4
https://www.vulncheck.com/advisories/better-auth-scim-before-beta-4-authorization-bypass
https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de better-auth SCIM desde la 1.5.0 y anteriores a la 1.7.0-beta.4 fallan al vincular por defecto los proveedores SCIM no organizacionales a su creador, permitiendo a los usuarios autenticados gestionar los proveedores de otros usuarios. Los atacantes pueden regenerar tokens portadores SCIM, invalidar tokens legítimos y autenticarse en las rutas de la API SCIM con el token controlado por el atacante.

Information

Published : 2026-08-01 13:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-67331

Mitre link : CVE-2026-67331

CVE.ORG link : CVE-2026-67331

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-67331", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67331", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T17:46:33.931598Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "better-auth", "product": "scim", "versions": [{"status": "affected", "version": "1.5.0", "lessThan": "1.7.0-beta.4", "versionType": "semver"}, {"status": "unaffected", "version": "1.7.0-beta.4", "versionType": "semver"}], "packageURL": "pkg:npm/%40better-auth/scim", "defaultStatus": "unaffected"}]}], "published": "2026-08-01T13:17:03.833", "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/better-auth-scim-before-beta-4-authorization-bypass", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token."}, {"lang": "es", "value": "Las versiones de better-auth SCIM desde la 1.5.0 y anteriores a la 1.7.0-beta.4 fallan al vincular por defecto los proveedores SCIM no organizacionales a su creador, permitiendo a los usuarios autenticados gestionar los proveedores de otros usuarios. Los atacantes pueden regenerar tokens portadores SCIM, invalidar tokens leg\u00edtimos y autenticarse en las rutas de la API SCIM con el token controlado por el atacante."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "disclosure@vulncheck.com"}