Vulnerability Description
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5q
- https://www.vulncheck.com/advisories/better-auth-scim-before-beta-4-authorizatio
- https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5q
FAQ
What is CVE-2026-67331?
CVE-2026-67331 is a vulnerability with a CVSS score of 8.3 (HIGH). better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attack...
How severe is CVE-2026-67331?
CVE-2026-67331 has been rated HIGH with a CVSS base score of 8.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-67331?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.