Skip to content
OpenAdvisories

Package · npm

@better-auth/scim

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Low 3.8
    CVE-2026-67334

    better-auth Stale Sessions Persist After User Deletion

    better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain …

    better-auth better-auth better-auth @better-auth/scim npm
  • High 8.3
    CVE-2026-67331

    better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass

    better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimat…

    better-auth scim @better-auth/scim npm
  • Critical 9.9
    CVE-2026-67330

    better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision

    @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic…

    better-auth scim @better-auth/scim npm