{"id":"CVE-2026-67330","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-01T13:17:03.677","lastModified":"2026-10-23T23:10:00.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0)."},{"lang":"es","value":"Las versiones de @better-auth/scim (un plugin de better-auth) >= 1.4.0-beta.27 hasta menor o igual que 1.6.21 y >= 1.7.0-beta.0 hasta menor o igual que 1.7.0-beta.9 contienen un bypass de autorización. La emisión de tokens SCIM no rechazaba IDs de proveedor ya utilizados por proveedores de SSO, SAML, OIDC, OAuth genérico o cuentas sociales existentes, y el mismo ID de proveedor lógico se utilizaba tanto para la configuración del proveedor SCIM como para la propiedad de la cuenta. Un usuario autenticado podía acuñar un token SCIM cuyo ID de proveedor colisionaba con un espacio de nombres de proveedor existente, haciendo que las rutas de usuario SCIM resolvieran filas de cuentas que el token nunca aprovisionó. Esto permitía listar, leer, actualizar (incluyendo la reescritura de campos globales de perfil/correo electrónico sin verificaciones de unicidad), y eliminar cuentas de usuario y sesiones globales, lo que resultaba en la toma de control de cuentas (account takeover) y desaprovisionamiento no autorizado. Corregido en 1.6.22 y 1.7.0-beta.10 (1.7.0-rc.0)."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"better-auth","product":"scim","defaultStatus":"unaffected","packageURL":"pkg:npm/%40better-auth/scim","versions":[{"version":"1.4.0-beta.27","lessThan":"*","versionType":"semver","status":"affected"}]},{"vendor":"better-auth","product":"scim","defaultStatus":"unaffected","packageURL":"pkg:npm/%40better-auth/scim","versions":[{"version":"1.7.0-beta.0","lessThan":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-03T14:48:18.589429Z","id":"CVE-2026-67330","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/better-auth-scim-beta-27-through-account-takeover-via-provider-id-collision","source":"disclosure@vulncheck.com"}]}