Critical Auth Bypass Found in Better-Auth SCIM

Security researchers have identified a critical authorization bypass vulnerability, tracked as CVE-2026-67330, affecting the @better-auth/scim plugin. With a CVSS score of 9.9, this flaw allows an authenticated user to perform a provider ID collision, granting them unauthorized control over global user accounts and sessions.

What's at Risk

The vulnerability impacts @better-auth/scim versions 1.4.0-beta.27 through 1.6.21, and versions 1.7.0-beta.0 through 1.7.0-beta.9. Organizations utilizing these versions of the plugin for System for Cross-domain Identity Management (SCIM) are at risk of complete account takeover.

Systems that are internet-facing or those that manage centralized identity and access control are particularly exposed. Because this flaw involves the core authentication logic, any application relying on the affected plugin to manage user identity is a potential target for attackers seeking to rewrite profile data, modify email addresses, or deprovision legitimate users.

How the Flaw Works

This vulnerability stems from an authorization bypass caused by improper validation of provider namespaces. In general, when an authentication system fails to isolate provider IDs, it creates a collision where a malicious actor can register an identifier that overlaps with existing, trusted authentication sources like SAML or OIDC.

When these namespaces are not strictly segregated, the application's backend may mistakenly resolve a request from a low-privilege token to a high-privilege account record. In practice, this class of vulnerability often allows an attacker to bypass standard ownership checks. Once the system incorrectly maps the attacker's session to an existing user record, the attacker can typically perform administrative actions, such as modifying global account attributes or terminating sessions, as if they were the legitimate account owner.

How to Protect Your Systems

• Upgrade immediately to better-auth/scim version 1.6.22 or 1.7.0-beta.10 (or 1.7.0-rc.0) to resolve the underlying collision logic.
• Audit your SCIM provider configuration to ensure that no overlapping or duplicate provider IDs exist across your SSO and social login namespaces.
• Review recent authentication logs for anomalous account modifications or unauthorized profile updates that occurred while using the vulnerable versions.
• Ensure that your authentication infrastructure follows the principle of least privilege, restricting which users have the authority to generate or manage SCIM tokens.
• Implement strict input validation and uniqueness constraints on all user-controlled provider identifiers to prevent similar namespace collisions in the future.

Given the 9.9 severity rating and the potential for full account takeover, organizations must prioritize these updates. Vulnerabilities that permit unauthorized access to global account data represent a significant threat to user privacy and system integrity, making prompt patching the most effective defense against potential exploitation.