@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass…

CVE-2026-67330 affects the @better-auth/scim plugin for better-auth across versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9. The vulnerability stems from a flaw in SCIM token issuance that failed to reject provider IDs already in use by existing SSO, SAML, OIDC, OAuth, or social account providers. An authenticated attacker could mint a SCIM token with a provider ID that collides with an existing provider namespace, causing SCIM user routes to resolve account records not provisioned by that token. This allowed unauthorized listing, reading, updating, and deletion of global user accounts and sessions. Profile and email fields could be rewritten without uniqueness checks, enabling full account takeover and unauthorized deprovisioning. The root cause is the shared logical provider ID between SCIM provider configuration and account ownership, creating a namespace collision vulnerability. Fixes are available in versions 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0). Organizations using affected versions should upgrade immediately given the critical nature of account takeover risk.