External risk intelligence

@better-auth SCIM Authorization Bypass Leads to Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-67330

This vulnerability exists in an authentication and provisioning plugin (SCIM) for web applications. SCIM endpoints and authentication providers are commonly exposed as internet-facing services or APIs to facilitate identity management and single sign-on (SSO) integration in modern web application deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A plugin used for authentication and user provisioning has a flaw that could allow unauthorized access and control of user accounts. This occurs when the system incorrectly handles specific identifiers used for connecting different authentication methods.

Account takeover due to authentication identifier flaw.
Affects user management and identity services.
Confirm if this authentication plugin is in use.

Attack Path

How an attacker could exploit the issue

An authenticated user can exploit an authorization bypass in the SCIM token issuance of the @better-auth/scim plugin. By minting a SCIM token with a provider ID that conflicts with an existing Single Sign-On (SSO) provider, an attacker can manipulate SCIM user routes to access and control other user accounts. This allows for unauthorized actions such as listing, reading, updating, and deleting global user data, potentially leading to a full account takeover.

Requires authenticated user access.
Mints SCIM token with colliding provider ID.
Leads to account takeover and unauthorized actions.

Live Threat

Current exploitation, exposure, and threat context

An authenticated user could exploit this vulnerability to gain unauthorized access to and control over global user accounts and sessions. This could lead to account takeover, unauthorized data modification, or deletion of user accounts and sessions when supported by the advisory.

Global user accounts and sessions at risk.
Account takeover and unauthorized deprovisioning.
Listing, reading, updating, and deleting global user accounts.

Operational Fix

Recommended remediation, mitigation, and detection steps

The @better-auth/scim plugin is likely managed by platform or application teams responsible for identity and access management. The first practical step is to identify all instances of this plugin, determine their reachability and criticality, and identify the accountable owner for each. Remediation planning should then follow, prioritizing critical or exposed systems.

Platform or application teams own this issue.
Verify SCIM provider ID configurations.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is @better-auth/scim?

@better-auth/scim is a plugin for the better-auth framework that handles System for Cross-domain Identity Management (SCIM). Developers use it to automate the exchange of user identity information between different systems, which is essential for managing user provisioning and synchronization in modern web applications.

What does this authorization bypass mean for CVE-2026-67330?

This vulnerability, classified as Improper Input Validation (CWE-20), occurs because the system fails to check if a new SCIM token's provider ID is already in use. By choosing a colliding ID, an attacker tricks the system into treating their token as authorized for other users' accounts, bypassing security checks and gaining full control over target profiles or sessions.

How does an attacker trigger this vulnerability?

An attacker needs an authenticated account within the application to perform the attack. They trigger the flaw by minting a SCIM token using a provider ID that matches an existing SSO, SAML, or OAuth provider already configured in the system. This collision does not occur if the provider IDs are unique and do not overlap with existing account ownership namespaces.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal labels this as Likely because SCIM endpoints and authentication providers are frequently exposed as internet-facing APIs. If your application uses this plugin to manage identity and SSO integrations, your environment is potentially accessible to the same network paths that attackers target, increasing the likelihood that this vulnerability is reachable.

How do I address this CVE-2026-67330 flaw?

Start by identifying all services in your environment running the @better-auth/scim plugin and confirm which versions are in use. Because this is a code-level defect in the plugin, you must update to version 1.6.22 or 1.7.0-beta.10 (or later), which contain the logic to reject colliding provider IDs. Coordinate with your identity management team to apply these updates during your next maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.