Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck

CVE-2026-67331better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass

High 8.3

In plain English

A high-severity authorization bypass via user-controlled key in scim from better-auth. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.4%top 66.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@better-auth/scim	1.7.0-beta.4	GHSA-j8v8-g9cx-5qf4

Affected products (as reported)

Vendor	Product	Versions
better-auth	scim	1.5.0 – before 1.7.0-beta.4

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

GitHub Security Advisory (GHSA-j8v8-g9cx-5qf4) vendor-advisory
VulnCheck Advisory: better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass third-party-advisory