CVE-2026-67330 better-auth CVE debrief

Who should care

Users of the @better-auth/scim plugin, administrators of affected systems, security teams responsible for monitoring and protecting sensitive user data, and operators of platforms that utilize this plugin for user management should be aware of this vulnerability. Those responsible for vulnerability management, security assessments, and incident response may also need to take action to protect their environments. Additionally, developers and maintainers of systems that integrate with the @better-auth/scim plugin should review the vulnerability and take steps to ensure their systems are not exposed. Security teams should prioritize patching or mitigating this vulnerability to prevent potential account takeovers and unauthorized deprovisioning of user accounts. Monitoring and detection teams should also be aware of potential indicators of compromise related to this vulnerability. Asset owners and operators should conduct thorough inventory checks to identify potential vulnerable instances and prioritize remediation efforts. Change management and incident response teams should be prepared to respond to potential security incidents related to this vulnerability. Compliance and risk management teams should assess the potential impact of this vulnerability on their organization's security posture and take steps to mitigate potential risks. Communication and coordination between these teams are crucial to effectively manage and mitigate the risk associated with this vulnerability. Supplied official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance. Compensating controls for exposed systems should be implemented while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retest remediated assets, and close the item only after evidence is documented. Tracking and verifying the effectiveness of implemented controls is essential to ensure the vulnerability is properly mitigated. Review and update @better-auth/scim plugin to version 1.6.22 or 1.7.0-beta.10 (1.7.0-rc.0) or later. Implement compensating controls to monitor and restrict

Technical summary

The @better-auth/scim plugin versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass vulnerability. The SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers. This allowed listing, reading, updating, and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning.

Defensive priority

Critical vulnerability in @better-auth/scim plugin, allowing authorization bypass and potential account takeover.

Recommended defensive actions

• Review and update @better-auth/scim plugin to version 1.6.22 or 1.7.0-beta.10 (1.7.0-rc.0) or later
• Implement compensating controls to monitor and restrict access to sensitive user data
• Conduct thorough inventory checks to identify potential vulnerable instances
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The @better-auth/scim plugin versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass vulnerability. The SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers. This allowed listing, reading, updating, and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning.

Official resources