CVE-2026-67331

highCVSS 8.3covered by 1 sourcefirst seen 2026-08-01

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

⚡ Watch CVE-2026-67331

Get an email if CVE-2026-67331 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highCVE-2026-67331: better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM pr…nvd · 2026-08-01

External references

NVD record for CVE-2026-67331

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-67331 status](https://www.csirts.com/badge/CVE-2026-67331)](https://www.csirts.com/cve/CVE-2026-67331)