High severity8.3NVD Advisory· Published Aug 1, 2026· Updated Sep 8, 2026

CVE-2026-67331

Description

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Better Auth/Better Authllm-fuzzy
Range: <1.7.0-beta.4

Patches

Vulnerability mechanics

References

github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4nvd
www.vulncheck.com/advisories/better-auth-scim-before-beta-4-authorization-bypassnvd

News mentions

Better Auth: 17 Vulnerabilities Disclosed Together, Including Critical Authorization Bypass Flaws
Vypr Intelligence · Aug 2, 2026

cvss	0.540
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000