CVE-2026-67331

Name of the Vulnerable Software and Affected Versions better-auth SCIM versions 1.5.0 through 1.7.0-beta.3

Description By default, the @better-auth/scim plugin fails to bind non-organization (personal) SCIM providers to their creator. This occurs because the providerOwnership option and the scimProvider.userId column are disabled by default, allowing the access check to pass when no owner ID is present. Consequently, any authenticated user can manage other users' personal providers, including reading metadata, listing connections, and deleting connections. The most critical impact is the ability to regenerate SCIM bearer tokens via the /scim/generate-token endpoint using the providerId variable. This action invalidates the legitimate user's token and grants the attacker a valid token to authenticate against SCIM API routes, such as /scim/v2/Users, and manage SCIM-provisioned users.

Recommendations Upgrade to @better-auth/scim version 1.7.0-beta.4 or later and run the schema migration using npx auth migrate. As a temporary workaround, set providerOwnership: { enabled: true } during plugin registration and run the schema update to ensure the scimProvider.userId column exists. As an alternative mitigation, ensure all SCIM providers are scoped to an organization by always providing an organizationId. Restrict access to SCIM management endpoints at the network edge to minimize the risk of exploitation.