better-auth SCIM CVE-2026-67331

Exploitation requires all of the following conditions to hold simultaneously: the target application must have the @better-auth/scim plugin installed and registered (plugins: [scim()]); at least one non-organization (personal) SCIM provider must have been created - organization-scoped providers (those created with an organizationId) are not affected because they enforce organization membership separately; the deployment must have more than one authenticated user account so that cross-user targeting is possible; and the providerOwnership option must not have been explicitly set to { enabled: true }, which is the default. Exploitation is limited to authenticated users only (PR:L in CVSS 4.0 terms) - unauthenticated access to the management endpoints is not possible. The attack cannot reach organization-scoped providers or deployments with a single user.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) scores 8.7, reflecting network accessibility with no complexity or configuration prerequisites beyond holding a valid user session. The high confidentiality and integrity scores are appropriate: an attacker can exfiltrate provider metadata, rotate bearer tokens, and effectively hijack SCIM provisioning flows. The low availability component reflects legitimate token invalidation as a side effect. No EPSS data was provided in the input and no KEV listing is present, suggesting exploitation is not yet confirmed at scale. However, the risk is elevated by two factors: the 1.6.x stable release line remains unpatched (only a pre-release beta carries the fix), and the vulnerable code path requires only a standard authenticated session - no elevated privileges, no special role. This is a real priority for any multi-tenant deployment using non-org SCIM providers; the gap between high CVSS signal and absent KEV/EPSS data is consistent with a newly disclosed vulnerability rather than a low-risk finding.

An authenticated user on a multi-tenant application enumerates or guesses the provider ID of another user's non-org SCIM provider (provider IDs may be sequential or predictable), then calls the SCIM management token-regeneration endpoint with no additional credentials. The endpoint returns a fresh bearer token controlled by the attacker, while the legitimate owner's token is immediately invalidated, disrupting any active SCIM provisioning. The attacker then authenticates to the SCIM API using this token and can read, modify, or delete directory entries. No public exploit code is confirmed, but the attack requires only standard HTTP requests to the management API.