CVE-2026-67331 better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass
Authenticated users can manage other users' SCIM providers and tokens due to missing ownership checks, enabling unauthorized access and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-67331?
CVE-2026-67331 is a high-severity missing authorization vulnerability in better-auth scim, published on 1 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.
Weakness: CWE-639
Which versions are affected by CVE-2026-67331?
2 open source packages ship an affected version, including @better-auth/scim.
| Package | Affected | Fixed in |
|---|---|---|
@better-auth/scim npm | From 1.5.0 | 1.7.0-beta.4 |
@better-auth/scim npm | From 1.5.0 | 1.7.0-beta.4 |
How do I fix CVE-2026-67331?
Upgrade @better-auth/scim to 1.7.0-beta.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-67331 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67331 exists.
Sources
Also known as GHSA-gj37-5j8h-j367, GHSA-j8v8-g9cx-5qf4.