CVE-2026-67331 in better-auth
Summary
by MITRE • 08/01/2026
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/01/2026
The vulnerability in better-auth SCIM versions ranging from 1.5.0 through 1.7.0-beta.3 represents a critical authorization flaw that undermines the integrity of identity management operations. This issue stems from insufficient access control mechanisms that fail to properly validate user permissions when associating SCIM providers with their creators, creating a fundamental breach in the system's security model. The vulnerability manifests as a failure to enforce proper ownership boundaries, allowing authenticated users to manipulate resources they should not have access to.
The technical flaw lies in the application's inability to maintain proper authorization checks during provider creation and management processes. When SCIM providers are created, the system does not adequately verify that the requesting user has the appropriate permissions to bind that provider to their account. This creates a scenario where any authenticated user can potentially claim ownership of any SCIM provider within the system, effectively bypassing the intended access controls that should restrict provider management to authorized individuals only.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it enables attackers to conduct token manipulation operations that can severely compromise system security. Attackers who exploit this flaw can regenerate SCIM bearer tokens, essentially allowing them to assume the identity of legitimate users or create persistent access points within the system. This capability enables attackers to invalidate legitimate tokens, effectively locking out authorized users while maintaining their own unauthorized access to the SCIM API endpoints.
The authentication bypass opportunity presents a significant risk for privilege escalation and ongoing system compromise. Once an attacker gains control over SCIM API routes through manipulated tokens, they can perform operations that would normally require elevated privileges within the identity management framework. This includes modifying user accounts, creating new users, or accessing sensitive information through the SCIM interface, all while appearing to be legitimate system users.
This vulnerability aligns with CWE-285, which addresses improper authorization in software systems, and reflects patterns commonly seen in access control bypass scenarios. The issue demonstrates how weak session management and insufficient authentication checks can create persistent security weaknesses that allow attackers to maintain unauthorized access over extended periods. From an ATT&CK perspective, this vulnerability maps to T1566 (Phishing) and T1078 (Valid Accounts) as attackers can leverage the compromised tokens to establish persistent access and move laterally within the system.
Organizations should immediately implement mitigations including strict access control enforcement during provider creation, mandatory token validation checks, and enhanced monitoring of SCIM API usage patterns. The recommended solution involves implementing proper ownership verification mechanisms that ensure only authorized users can bind providers to their accounts, along with regular token rotation policies and comprehensive audit logging of all SCIM operations to detect unauthorized activities.
The vulnerability represents a clear failure in the principle of least privilege implementation, where the system does not properly enforce access controls that should prevent unauthorized manipulation of identity management resources. Security teams must prioritize patching this issue and implementing additional layers of protection around authentication tokens and provider management functions. Regular security assessments should verify that proper authorization mechanisms are in place to prevent similar issues from occurring in other components of the identity management infrastructure.
Organizations relying on better-auth SCIM implementations should conduct thorough security reviews to identify any other instances where similar authorization bypasses might exist, particularly in systems with complex user and resource relationship management. The vulnerability serves as a reminder of the critical importance of proper access control implementation in identity management systems, where failures in this area can result in widespread compromise of user accounts and system integrity.
This issue demonstrates how seemingly minor configuration or implementation flaws in identity management systems can create significant security risks when combined with other vulnerabilities. The ability to regenerate tokens and maintain unauthorized access through SCIM API routes represents a persistent threat that requires immediate attention and comprehensive remediation strategies. System administrators should implement continuous monitoring solutions specifically designed to detect anomalous SCIM API behavior and unauthorized provider manipulation attempts, ensuring timely detection and response to potential exploitation of this vulnerability.