A provider ID collision flaw in the @better-auth/scim plugin lets any authenticated user mint a SCIM token that reaches into other providers' account namespaces, enabling full account takeover and mass deprovisioning.
What Is It
CVE-2026-67330 is an authorization bypass (CWE-20) in @better-auth/scim, a plugin for the better-auth framework. SCIM token issuance failed to reject provider IDs that were already in use by existing SSO, SAML, OIDC, generic OAuth, or social account providers. Because the same logical provider ID governed both SCIM provider configuration and account ownership, an authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace.
The result: SCIM user routes resolved account rows the token never provisioned. VulnCheck, the disclosing source, rates it CVSS 3.1 9.9 (CRITICAL, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and CVSS 4.0 9.4.
Why It Matters
The attack requires only low privileges, no user interaction, and is reachable over the network with low complexity. Once the collision succeeds, an attacker can list, read, update, and delete global user accounts and sessions. Updates include rewriting global profile and email fields with no uniqueness checks; the direct path to account takeover. Deletion capability means unauthorized deprovisioning of legitimate users. The scope is marked CHANGED, reflecting impact beyond the vulnerable component into the identity data it governs.
What's Vulnerable
@better-auth/scim(purl:pkg:npm/%40better-auth/scim) versions >= 1.4.0-beta.27 through <= 1.6.21@better-auth/scimversions >= 1.7.0-beta.0 through <= 1.7.0-beta.9
Patch Status
Fixed in 1.6.22 and 1.7.0-beta.10 (also released as 1.7.0-rc.0). Operators running any affected version should upgrade to one of these releases.
As of 2026-08-01, CVE-2026-67330 does not appear in the CISA Known Exploited Vulnerabilities catalog, so no federal remediation deadline applies and no active exploitation has been publicly confirmed. That absence is not evidence exploitation is not occurring; KEV listings lag observed activity, and the catalog should be rechecked before treating this as unexploited. NVD status is "Received" as of 2026-08-01, meaning the record is still awaiting full analysis.
Sources
- NVD, CVE-2026-67330: https://nvd.nist.gov/vuln/detail/CVE-2026-67330
- GitHub Security Advisory GHSA-rjg6-39jm-rgg4: https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4
- VulnCheck Advisory: https://www.vulncheck.com/advisories/better-auth-scim-beta-27-through-account-takeover-via-provider-id-collision
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog