CVE-2026-67331 is an authorization bypass vulnerability in better-auth SCIM affecting versions from 1.5.0 up to but not including 1.7.0-beta.4. The flaw arises because the software fails to bind non-organization SCIM providers to their creator by default. As a result, authenticated users can manipulate other users' SCIM providers, including regenerating bearer tokens and authenticating with those tokens to SCIM API routes. This allows attackers to invalidate legitimate tokens and gain unauthorized access to SCIM functionalities.

An attacker with authenticated access can manage SCIM providers belonging to other users, regenerate bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with attacker-controlled tokens. This can lead to unauthorized access and potential disruption of SCIM services. The CVSS 4.0 score is 8.7 (high severity), reflecting the network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or temporary workaround indicated in the provided data. Users should monitor the vendor's advisories for updates and apply any forthcoming patches or mitigations promptly.