CVE-2026-67330

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67330", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-07-29T13:07:47.015Z", "datePublished": "2026-08-01T12:22:16.804Z", "dateUpdated": "2026-10-08T15:24:08.687Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:24:08.687Z"}, "datePublic": "2026-06-26T00:00:00.000Z", "title": "better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision", "descriptions": [{"lang": "en", "value": "@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0)."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Input Validation", "cweId": "CWE-20", "type": "CWE"}]}], "affected": [{"vendor": "better-auth", "product": "scim", "defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/scim", "versions": [{"version": "1.4.0-beta.27", "status": "affected", "versionType": "semver", "lessThan": "*"}]}, {"vendor": "better-auth", "product": "scim", "defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/scim", "versions": [{"version": "1.7.0-beta.0", "status": "affected", "versionType": "semver", "lessThan": "*"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL"}}], "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-rjg6-39jm-rgg4)"}, {"name": "VulnCheck Advisory: better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/better-auth-scim-beta-27-through-account-takeover-via-provider-id-collision"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-03T14:48:18.589429Z", "id": "CVE-2026-67330", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T15:38:15.885Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67330", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T14:48:18.589429Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-03T14:48:19.845Z"}}], "cna": {"title": "better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision", "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 9.4, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "better-auth", "product": "scim", "versions": [{"status": "affected", "version": "1.4.0-beta.27", "lessThan": "*", "versionType": "semver"}], "packageURL": "pkg:npm/%40better-auth/scim", "defaultStatus": "unaffected"}, {"vendor": "better-auth", "product": "scim", "versions": [{"status": "affected", "version": "1.7.0-beta.0", "lessThan": "*", "versionType": "semver"}], "packageURL": "pkg:npm/%40better-auth/scim", "defaultStatus": "unaffected"}], "datePublic": "2026-06-26T00:00:00.000Z", "references": [{"url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4", "name": "GitHub Security Advisory (GHSA-rjg6-39jm-rgg4)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/better-auth-scim-beta-27-through-account-takeover-via-provider-id-collision", "name": "VulnCheck Advisory: better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "Improper Input Validation"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-08T15:24:08.687Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67330", "state": "PUBLISHED", "dateUpdated": "2026-10-08T15:24:08.687Z", "dateReserved": "2026-07-29T13:07:47.015Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-01T12:22:16.804Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/scim", "product": "scim", "vendor": "better-auth", "versions": [{"lessThan": "*", "status": "affected", "version": "1.4.0-beta.27", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:npm/%40better-auth/scim", "product": "scim", "vendor": "better-auth", "versions": [{"lessThan": "*", "status": "affected", "version": "1.7.0-beta.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0)."}, {"lang": "es", "value": "Las versiones de @better-auth/scim (un plugin de better-auth) >= 1.4.0-beta.27 hasta menor o igual que 1.6.21 y >= 1.7.0-beta.0 hasta menor o igual que 1.7.0-beta.9 contienen un bypass de autorizaci\u00f3n. La emisi\u00f3n de tokens SCIM no rechazaba IDs de proveedor ya utilizados por proveedores de SSO, SAML, OIDC, OAuth gen\u00e9rico o cuentas sociales existentes, y el mismo ID de proveedor l\u00f3gico se utilizaba tanto para la configuraci\u00f3n del proveedor SCIM como para la propiedad de la cuenta. Un usuario autenticado pod\u00eda acu\u00f1ar un token SCIM cuyo ID de proveedor colisionaba con un espacio de nombres de proveedor existente, haciendo que las rutas de usuario SCIM resolvieran filas de cuentas que el token nunca aprovision\u00f3. Esto permit\u00eda listar, leer, actualizar (incluyendo la reescritura de campos globales de perfil/correo electr\u00f3nico sin verificaciones de unicidad), y eliminar cuentas de usuario y sesiones globales, lo que resultaba en la toma de control de cuentas (account takeover) y desaprovisionamiento no autorizado. Corregido en 1.6.22 y 1.7.0-beta.10 (1.7.0-rc.0)."}], "id": "CVE-2026-67330", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67330", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-03T14:48:18.589429Z", "version": "2.0.3"}}]}, "published": "2026-08-01T13:17:03.677", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/better-auth-scim-beta-27-through-account-takeover-via-provider-id-collision"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.4.0-beta.27,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "scim", "source": "cna", "vendor": "better-auth"}, "product": "scim", "vendor": "better-auth"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.7.0-beta.0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "scim", "source": "cna", "vendor": "better-auth"}, "product": "scim", "vendor": "better-auth"}], "created": "2026-08-02T20:31:40.898263+00:00", "updated": "2026-08-03T09:45:04.459263+00:00", "vendors": ["better-auth", "better-auth$PRODUCT$scim"]}