Skip to content
OpenAdvisories

Package · npm

@better-auth/scim

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.8
    CVE-2026-67334

    better-auth Stale Sessions Persist After User Deletion

    better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain …

    better-auth better-auth better-auth @better-auth/scim npm