CVE-2026-67331: better-auth SCIM Auth Bypass Vulnerability

CVE-2026-67331 Overview

CVE-2026-67331 is an authorization bypass vulnerability in the better-auth SCIM (System for Cross-domain Identity Management) plugin. Versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default. Authenticated users can manage SCIM providers belonging to other users. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with attacker-controlled tokens. The flaw is classified under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated user can hijack SCIM providers created by other tenants, gaining full control over identity provisioning bearer tokens and downstream SCIM API access.

Affected Products

better-auth SCIM plugin version 1.5.0
better-auth SCIM plugin versions up to but not including 1.7.0-beta.4
Applications integrating the affected better-auth SCIM plugin for non-organization provider flows

Discovery Timeline

2026-08-01 - CVE-2026-67331 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67331

Vulnerability Analysis

The better-auth library provides a SCIM plugin that enables identity provisioning between an application and external identity providers. SCIM providers created outside of an organization scope are not automatically bound to the creating user account. Because the ownership check is absent by default, the plugin authorizes any authenticated caller to operate on any non-organization SCIM provider record.

An authenticated attacker can enumerate provider identifiers and invoke management endpoints for providers they did not create. This exposes bearer token regeneration, revocation of legitimate tokens, and the ability to authenticate to SCIM API routes with an attacker-controlled token. Successful exploitation compromises confidentiality and integrity of identity provisioning data. Network-based exploitation requires only low privileges and no user interaction.

Root Cause

The root cause is missing owner binding on non-organization SCIM provider records. The plugin's authorization layer relies on the caller supplying a provider identifier without verifying that the identifier belongs to the caller. This maps directly to [CWE-639], where access control decisions are made using user-controlled keys rather than server-enforced ownership.

Attack Vector

An authenticated user sends requests to SCIM provider management routes referencing a provider identifier owned by another user. Because ownership is not enforced, the request succeeds. The attacker can then call the bearer token regeneration endpoint to obtain a fresh token, or invalidate the existing token to disrupt legitimate provisioning. The regenerated token is then used against SCIM API routes to read or modify provisioned identities.

No verified public exploit code is currently available. See the GitHub Security Advisory and the VulnCheck Advisory Report for maintainer-published technical details.

Detection Methods for CVE-2026-67331

Indicators of Compromise

SCIM bearer token regeneration events on providers not associated with the requesting user account
Unexpected 401 or authentication failures from legitimate SCIM integrations after a token was silently rotated
SCIM API calls authenticated with a bearer token that was issued outside of the normal provisioning workflow

Detection Strategies

Correlate the actor identity on SCIM provider management requests with the stored creator of the target provider record and alert on mismatches
Alert on repeated enumeration of SCIM provider identifiers by a single authenticated principal
Baseline the rate of SCIM bearer token regeneration events and flag deviations, particularly outside change windows

Monitoring Recommendations

Log every call to SCIM provider management and token endpoints with the authenticated user, target provider identifier, source IP, and result
Forward better-auth application logs to a centralized platform for correlation with identity provider activity
Monitor downstream identity providers for provisioning actions performed with newly issued bearer tokens

How to Mitigate CVE-2026-67331

Immediate Actions Required

Upgrade the better-auth SCIM plugin to version 1.7.0-beta.4 or later
Rotate all existing SCIM bearer tokens after upgrading to invalidate any attacker-issued tokens
Audit SCIM provider records for unexpected owners, unknown providers, or recently regenerated tokens
Review application authentication logs for management calls on providers not owned by the calling user

Patch Information

The maintainers fixed the issue in better-auth1.7.0-beta.4. The patch binds non-organization SCIM providers to their creator and enforces ownership checks on provider management and token operations. Refer to the GitHub Security Advisory GHSA-j8v8-g9cx-5qf4 for the authoritative fix reference.

Workarounds

Restrict access to SCIM management endpoints at the reverse proxy or API gateway to a small set of trusted administrator accounts until the upgrade is applied
Disable the SCIM plugin for non-organization flows if the deployment does not require them
Scope SCIM providers to organizations where feasible so existing organization-level access control applies

bash

# Upgrade better-auth to a fixed release
npm install better-auth@">=1.7.0-beta.4"

# Verify the installed version
npm ls better-auth