Authorization bypass in @better-auth/scim via provider-id collision (CVE-2026-67330)

The @better-auth/scim plugin used the same logical provider ID for SCIM provider configuration and account ownership, and SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This permitted listing, reading, updating (including rewriting global profile and email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Affected versions: - >= 1.4.0-beta.27, <= 1.6.21 - >= 1.7.0-beta.0, <= 1.7.0-beta.10 We recommend updating to: 1.6.22, 1.7.0-rc.0. CVSS 9.4 · our assessment: act_now Reference: https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4 Details: https://vuln.today/cve/CVE-2026-67330