{"cve":"CVE-2026-67330","nvd":{"published":"2026-08-01T13:17:03.677","modified":"2026-10-23T23:10:00.157","status":"Deferred","description":"@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.4},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9},"cwes":["CWE-20"],"references":["https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4","https://www.vulncheck.com/advisories/better-auth-scim-beta-27-through-account-takeover-via-provider-id-collision"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:34.184483516+00:00"},"epss":{"cve":"CVE-2026-67330","score":0.00598,"percentile":0.48344,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-rjg6-39jm-rgg4","url":"https://osv.dev/vulnerability/GHSA-rjg6-39jm-rgg4","summary":"@better-auth/scim: account takeover and stale access via SCIM provider-id collision","modified":"2026-10-20T12:11:18.843019420Z","packages":[{"ecosystem":"npm","name":"@better-auth/scim","purl":"pkg:npm/%40better-auth/scim","ranges":[">=1.4.0-beta.27 <1.6.22"],"fixed":["1.6.22"]},{"ecosystem":"npm","name":"@better-auth/scim","purl":"pkg:npm/%40better-auth/scim","ranges":[">=1.7.0-beta.0 <1.7.0-beta.10"],"fixed":["1.7.0-beta.10"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}