HIGHVulnerability

CVE-2026-67331

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

Properties

severity
HIGH
score
8.3
epss_score
0.0024
cve_id
CVE-2026-67331
vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
published_at
2026-08-01T13:17:03.833
last_modified
2026-09-08T20:34:34.997
epss_percentile
0.14952

Related Entities (3)

ENRICHED_BY (1)

[Source]FIRST EPSS

DESCRIBED_BY (1)

[Source]NVD

HAS_WEAKNESS (1)

[Weakness]Authorization Bypass Through User-Controlled Key

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-67331 — Ninja Signal Threat Intelligence | Ninja Signal