EUVD-2026-51846
GHSA-gj37-5j8h-j367
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with low privilege (valid session only); high C/I from token hijack and provider takeover; low A from legitimate token invalidation.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.
AnalysisAI
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully take over another user's non-organization SCIM provider by exploiting a missing ownership binding. The root flaw (CWE-639) means provider rows are created without a userId by default, causing the access check to pass silently for any caller. An attacker with a valid session can regenerate a victim's SCIM bearer token, invalidating the legitimate token and authenticating to SCIM API routes with the attacker-controlled credential. No public exploit or KEV listing is confirmed at time of analysis, but the CVSS 4.0 score of 8.7 reflects the low exploitation complexity for any authenticated user.
Technical ContextAI
The @better-auth/scim plugin (CPE: cpe:2.3:a:better-auth:scim:*:*:*:*:*:*:*:*) implements the SCIM 2.0 provisioning protocol for the better-auth JavaScript authentication framework. The vulnerability is classified as CWE-639 (Authorization Through User-Controlled Key), an IDOR-family weakness. Provider ownership is tracked via an opt-in providerOwnership flag and a scimProvider.userId column, both disabled by default. The access control guard evaluates provider.userId && provider.userId !== userId - when userId is null (the default for non-org providers), the first operand is falsy and the condition short-circuits, granting access to any authenticated caller regardless of actual ownership. Organization-scoped providers are not affected because they enforce organization membership and role separately. The flaw spans all SCIM management operations: metadata reads, connection listing, token generation and regeneration, and connection deletion.
RemediationAI
The primary fix is upgrading @better-auth/scim to version 1.7.0-beta.4, which makes owner binding mandatory and removes the providerOwnership opt-in, adding a permanent scimProvider.userId column. This is a breaking change: after upgrading, run the schema migration with npx auth migrate. Providers created before the upgrade will have no userId and become unreachable through management endpoints; reclaim them directly at the database level by setting the userId column. The 1.6.x stable line is not patched and has no confirmed release timeline for a backport. Developers who cannot upgrade to the beta may apply the workaround of explicitly setting providerOwnership: { enabled: true } in the plugin configuration, which activates the ownership check and binds new providers to their creator - but pre-existing provider rows with no userId will still require a manual database fix. Restricting the SCIM management endpoints to internal networks or specific authenticated roles provides an additional compensating control, at the cost of reducing provider self-service capabilities. Full advisory: https://github.com/better-auth/better-auth/security/advisories/GHSA-j8v8-g9cx-5qf4.
More in Better Auth
View allBetter Auth is an authentication library for TypeScript. Rated high severity (CVSS 7.9), this vulnerability is remotely
Authorization bypass in the @better-auth/oauth-provider plugin for Better Auth (versions >= 1.4.8-beta.7 and < 1.6.5, pl
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-b
Authentication bypass in Better Auth before 1.6.11 stems from insecure cryptographic defaults in the legacy oidcProvider
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base pat
Path normalization bypass in Better Auth before v1.4.5 allows unauthenticated remote attackers to circumvent `disabledPa
Pre-account hijacking in better-auth (npm) allows a remote attacker to gain persistent, password-based access to any vic
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers
Two domain-ownership authentication bypass flaws in @better-auth/sso allow authenticated organization owners to compromi
Two-factor authentication bypass in better-auth (npm) before version 1.4.9 allows network-accessible attackers holding v
Privilege escalation in Better Auth SSO plugin (1.2.10 to <1.6.11) allows any authenticated organization member to regis
Open redirect in the better-auth npm authentication library before version 1.1.21 enables one-click account takeover whe
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today