CVE-2026-67331Patch

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-67331/

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters91d
Patch
CVE-2026-67331 - Critical auth flaw in Better-Auth SCIM. Unbound providers let attackers steal tokens, hijack SCIM API access. CVSS 8.3. Unpatched - update immediately if affected. #CVE #infosec #BetterAuth #cybersecurityawareness #cyebrsecuritytips #cybersecuritynews #devops #devsecops #developer #developers #git #gitlab #github #sysadmin #redteam #blueteam #python #linux #kali #hacker #ethicalhacker #ethicalhacking https://www.valtersit.com/cve/CVE-2026-67331/
Post summary
The post announces CVE‑2026‑67331, a critical authentication flaw in Better‑Auth SCIM that allows token theft and API hijack, highlights its CVSS 8.3 score, and urges users to apply an unprovided patch immediately.
0000065
979 followersView on X

Explore more

Back to dashboard