CVE-2026-67330— better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| better-auth | scim | 1.4.0-beta.27< * | affected |
1.7.0-beta.0< * | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-67330
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision
Source: CVE Program / CVE List V5
Vulnerability Description
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
better-auth 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
better-auth是better-auth团队开源的一个身份验证框架。 better-auth 1.4.0-beta.27版本至1.6.21版本和1.7.0-beta.0版本至1.7.0-beta.9版本存在输入验证错误漏洞，该漏洞源于SCIM令牌签发未拒绝已被现有SSO、SAML、OIDC、通用OAuth或社交账户提供程序使用的提供程序ID，导致同一逻辑提供程序ID被用于SCIM提供程序配置和账户所有权，可能允许已认证用户利用提供程序ID冲突，导致账户接管和未授权取消配置。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| better-auth | scim | 1.4.0-beta.27 ~ * | - | |
| better-auth | scim | 1.7.0-beta.0 ~ * | - |
II. Public POCs for CVE-2026-67330
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7599 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-67330
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-67330 (2)
Same Patch Batch · better-auth · 2026-08-01 · 14 CVEs total
| CVE-2026-67336 | 8.7 HIGH | better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider |
| CVE-2026-67327 | 8.3 HIGH | better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP |
| CVE-2026-67331 | 8.3 HIGH | better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass |
| CVE-2026-67328 | 8.1 HIGH | @better-auth/sso before 1.6.21 Account Takeover via SSO |
| CVE-2026-67333 | 7.2 HIGH | better-auth before 1.6.13 Stored XSS via javascript redirect_uri |
| CVE-2026-67329 | 7.1 HIGH | @better-auth/stripe before 1.6.21 Authorization Bypass via Organization Subscription |
| CVE-2025-71403 | 7.1 HIGH | better-auth before 1.1.20 Open Redirect via trustedOrigins Bypass |
| CVE-2026-67337 | 6.5 MEDIUM | better-auth before 1.4.9 Two-Factor Authentication Bypass via session.cookieCache |
| CVE-2026-67332 | 6.4 MEDIUM | @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass |
| CVE-2026-67335 | 5.3 MEDIUM | better-auth before 1.6.2 OAuth State Validation Bypass |
| CVE-2025-71404 | 5.1 MEDIUM | better-auth before 1.1.16 Reflected XSS via error parameter |
| CVE-2026-67334 | 3.8 LOW | better-auth Stale Sessions Persist After User Deletion |
| CVE-2025-71402 | 2.0 LOW | better-auth before 1.4.0 Session Revocation via Forged Cookie |
IV. Related Vulnerabilities
Same vendor: better-auth
- CVE-2025-71401
better-auth before 1.4.2 basePath Modification DoS - CVE-2025-71400
better-auth passkey before 1.4.0 IDOR via delete-passkey - CVE-2025-71399
Better Auth before 1.4.5 Path Normalization Bypass via rou3 - CVE-2026-67336
better-auth before 1.6.11 Insecure Cryptographic Defaults vi - CVE-2026-67327
better-auth before 1.6.22 Account Takeover via Magic-Link Em
Same weakness: CWE-20
- CVE-2026-18801
Stored Clickhouse SQL Injection Through Customer Usage Attri - CVE-2026-18772
Samsung rlottie反序列化漏洞 - CVE-2026-69198
ip-address: a CIDR suffix on the parsed address suppresses s - CVE-2026-69192
ip-address: Address4 decodes leading-zero octets as decimal - CVE-2026-69185
Socket.IO: Zero-attachment Memory Exhaustion
V. Comments for CVE-2026-67330
No comments yet