CVE-2026-67330: better-auth SCIM Auth Bypass Vulnerability

CVE-2026-67330 Overview

CVE-2026-67330 is an authorization bypass in the @better-auth/scim plugin for better-auth. The flaw affects versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9. SCIM token issuance failed to reject provider IDs already claimed by existing SSO, SAML, OIDC, generic OAuth, or social account providers. Because the same logical provider ID governed both SCIM provider configuration and account ownership, an authenticated attacker could mint a SCIM token that collides with an existing provider namespace. The colliding token resolves account rows the SCIM tenant never provisioned, enabling full account takeover.

Critical Impact
An authenticated user can list, read, update, and delete global user accounts and sessions across foreign identity providers, resulting in account takeover and unauthorized deprovisioning.

Affected Products

@better-auth/scim versions >= 1.4.0-beta.27 through <= 1.6.21
@better-auth/scim versions >= 1.7.0-beta.0 through <= 1.7.0-beta.9
better-auth deployments using SCIM alongside SSO, SAML, OIDC, OAuth, or social providers

Discovery Timeline

2026-08-01 - CVE-2026-67330 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67330

Vulnerability Analysis

The @better-auth/scim plugin issues SCIM (System for Cross-domain Identity Management) tokens scoped to a provider ID. The plugin treated SCIM provider IDs as an isolated namespace, but the underlying account store uses the same logical providerId field to associate accounts with SSO, SAML, OIDC, OAuth, and social identities. When SCIM token issuance skipped a uniqueness check, an authenticated caller could request a token bound to a providerId already in use by another provider type. SCIM user routes then resolved account rows belonging to that foreign provider, granting the token holder read and write access to accounts they never provisioned. The classification aligns with improper input validation [CWE-20].

Root Cause

The root cause is missing cross-namespace validation on SCIM token issuance combined with a shared identifier for provider configuration and account ownership. The plugin never verified that the requested providerId was unclaimed by other authentication providers registered in the same better-auth instance.

Attack Vector

An attacker authenticates to the target application with any valid user account. The attacker enumerates or guesses provider IDs used by SSO, SAML, OIDC, OAuth, or social providers configured in the deployment. The attacker requests a SCIM token bound to a colliding provider ID. Using the resulting token, the attacker calls SCIM user endpoints to enumerate victim accounts, rewrite global profile and email fields without uniqueness enforcement, and delete user rows or active sessions. The result is full account takeover and unauthorized deprovisioning across the affected identity provider namespace.

See the GitHub Security Advisory and the VulnCheck Security Advisory for vendor technical details.

Detection Methods for CVE-2026-67330

Indicators of Compromise

SCIM token issuance events where the requested providerId matches an existing SSO, SAML, OIDC, OAuth, or social provider identifier.
SCIM Users endpoint calls returning accounts whose providerId was never populated through SCIM provisioning workflows.
Unexpected PATCH or PUT requests to SCIM user routes that rewrite email or profile fields on accounts owned by federated providers.
Sudden bulk DELETE calls to SCIM user or session endpoints from a single authenticated principal.

Detection Strategies

Correlate better-auth SCIM audit logs against the configured provider registry and alert on any providerId reuse across provider types.
Baseline normal SCIM traffic per tenant and flag deviations in request volume, endpoint mix, or target account provider type.
Inspect application logs for account modification events attributed to SCIM tokens on users originally created through SSO, SAML, OIDC, OAuth, or social login.

Monitoring Recommendations

Enable verbose logging on SCIM token issuance and record the requesting user, requested providerId, and issuance outcome.
Alert on account email changes that bypass uniqueness validation or occur outside standard self-service flows.
Track session invalidation and account deletion events initiated via SCIM and require review when they affect federated accounts.

How to Mitigate CVE-2026-67330

Immediate Actions Required

Upgrade @better-auth/scim to version 1.6.22 on the 1.6.x branch or to 1.7.0-beta.10 (equivalent to 1.7.0-rc.0) on the 1.7.x branch.
Audit all issued SCIM tokens and revoke any whose providerId matches an existing SSO, SAML, OIDC, OAuth, or social provider.
Review recent account and session changes on federated identities for unauthorized modifications or deletions.

Patch Information

The maintainers fixed the issue in @better-auth/scim1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0). The fix rejects SCIM token issuance for provider IDs already claimed by other providers and separates SCIM provider identifiers from account ownership resolution. Details are published in the GitHub Security Advisory GHSA-rjg6-39jm-rgg4.

Workarounds

Restrict SCIM token issuance to trusted administrators until the patched version is deployed.
Enforce out-of-band uniqueness checks that reject any SCIM providerId matching an SSO, SAML, OIDC, OAuth, or social provider identifier.
Rotate and reissue SCIM tokens after upgrading to ensure no colliding tokens remain valid.

bash

# Upgrade the vulnerable plugin to a fixed release
npm install @better-auth/scim@1.6.22
# or, for the 1.7 branch
npm install @better-auth/scim@1.7.0-rc.0