What is CVE-2026-67330?

CVE-2026-67330 is a critical-severity vulnerability in Better-auth Scim, classified under Improper Input Validation. CVSS score: 9.9/10. Published 2026-08-01.

How severe is CVE-2026-67330?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Improper input validation in Better-auth Scim

CVE-2026-67330

@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO…

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Affected products

Better-auth Scim — versions 1.4.0-beta.27, 1.7.0-beta.0

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-67330?: CVE-2026-67330 is a critical-severity vulnerability in Better-auth Scim, classified under Improper Input Validation. CVSS score: 9.9/10. Published 2026-08-01.
How severe is CVE-2026-67330?: Critical severity. CVSS v3 base score is 9.9 out of 10.