{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-67330/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-67330"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@better-auth/scim"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","scim","identity-management","cve-2026-67330"],"_cs_type":"advisory","_cs_vendors":["Better Auth"],"content_html":"\u003cp\u003eThe @better-auth/scim plugin is susceptible to an authorization bypass vulnerability identified as CVE-2026-67330, affecting versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9. The flaw resides in the SCIM token issuance logic, which fails to restrict provider IDs to those uniquely belonging to the SCIM configuration.\u003c/p\u003e\n\u003cp\u003eBecause the system uses the same logical provider ID for both SCIM configuration and account ownership, an authenticated user can craft a SCIM token with a provider ID that matches an existing SSO, SAML, OIDC, or social account provider. When this malicious token is used, the system incorrectly resolves the request to account rows that were not provisioned by that specific SCIM token. This allows an attacker to interact with global user accounts and sessions belonging to other providers, facilitating profile and email manipulation without uniqueness checks, unauthorized data exfiltration, and account takeover. The vulnerability is resolved in versions 1.6.22 and 1.7.0-beta.10.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a severe risk of account takeover and unauthorized administrative control over user sessions. By manipulating global user profile fields and email addresses, an attacker can hijack accounts or delete them entirely, causing significant service disruption and loss of confidentiality for all identity providers integrated through the affected @better-auth/scim plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the @better-auth/scim plugin to version 1.6.22 or 1.7.0-beta.10 immediately to remediate CVE-2026-67330.\u003c/li\u003e\n\u003cli\u003eAudit application logs for abnormal SCIM administrative activity or mass profile modification events associated with non-standard provider ID patterns.\u003c/li\u003e\n\u003cli\u003eReview all existing SCIM token configurations to ensure provider ID namespaces are not colliding with other established SSO or OIDC providers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-01T13:51:03Z","date_published":"2026-08-01T13:51:03Z","id":"https://feed.craftedsignal.io/briefs/2026-08-01-better-auth-scim-auth-bypass/","summary":"An authorization bypass vulnerability in @better-auth/scim allows authenticated users to mint tokens that collide with provider IDs, enabling unauthorized modification and takeover of global user accounts.","title":"Authorization Bypass in @better-auth/scim Plugin","url":"https://feed.craftedsignal.io/briefs/2026-08-01-better-auth-scim-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-67330","version":"https://jsonfeed.org/version/1.1"}