EUVD-2026-51859
GHSA-6mwf-73fj-3358
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable REST endpoints with a low-privileged authenticated token (PR:L) and low complexity for the token-only delete/email paths; scope changes (S:C) because the SCIM plugin manipulates the broader user-account authority, with full CIA impact from read, takeover, and deletion.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).
AnalysisAI
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9) lets an authenticated low-privileged user mint a SCIM bearer token whose provider ID collides with an existing SSO, SAML, OIDC, generic OAuth, or social provider namespace, causing SCIM user routes to operate on global accounts the token never provisioned. Attackers can list, read, rewrite (email/profile with no uniqueness check), and delete arbitrary Better Auth users and sessions, yielding full account takeover and unauthorized deprovisioning. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor's detailed root-cause writeup makes exploitation straightforward once the plugin is enabled.
Technical ContextAI
SCIM (System for Cross-domain Identity Management) is a REST-based provisioning protocol identity providers use to create, update, and delete accounts in downstream applications. Better Auth is a TypeScript authentication framework, and @better-auth/scim adds SCIM v2 endpoints to it. The root cause maps to CWE-20 (Improper Input Validation): the SCIM bearer middleware decoded a provider ID from the token and used that same logical provider ID both to load the scimProvider configuration row and to query ordinary account rows via account.providerId. Because token issuance did not reject provider IDs already claimed by other account-provider namespaces (SSO/SAML/OIDC/OAuth/social), the provider ID became a user-controlled authorization key. The affected package is npm @better-auth/scim (cpe:2.3:a:better-auth:scim:*), with two compounding write-path defects: SCIM active:false was not modeled (deprovisioning could silently no-op) and PUT/PATCH updates changed global email addresses without the create path's uniqueness check while leaving emailVerified stale.
RemediationAI
Vendor-released patch: upgrade to @better-auth/scim 1.6.22 (for the 1.4.x-1.6.x line) or 1.7.0-beta.10 / 1.7.0-rc.0 (for the 1.7 pre-release line); the fix is in PR https://github.com/better-auth/better-auth/pull/10242 and commit 7c126dcd1aad24468ec37e876545c1d083d8acca. If you cannot upgrade immediately, tighten the canGenerateToken policy to reject any provider ID that already exists in your SSO/SAML/OIDC/generic OAuth or social provider tables, which closes the collision path but does not stop the token-only deprovisioning and email-rewrite issues. As a stronger stopgap, disable SCIM token generation for regular authenticated users (restrict issuance to trusted admins) or unregister the SCIM plugin entirely until patched - the trade-off is loss of self-service and automated identity-provider provisioning during the outage. Refer to the advisory at https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4 for exact guidance.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully tak
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromi
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover whe
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today