Threats Tagged 'ghsa-j8v8-g9cx-5qf4'
View all threats tagged with 'ghsa-j8v8-g9cx-5qf4'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-j8v8-g9cx-5qf4'
Click on any threat for detailed analysis and mitigation recommendations
GHSA-j8v8-g9cx-5qf4: @better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers 0 The @better-auth/scim plugin versions from 1.5.0 onward have a vulnerability affecting non-organization (personal) SCIM providers when the providerOwnership option is not enabled. This allows any authenticated user in a multi-user deployment to manage another user's non-org SCIM provider, including reading metadata, listing connections, regenerating SCIM bearer tokens, and deleting connections. Regenerating a token invalidates the legitimate user's token and grants the attacker a valid token, enabling account/provider takeover. Organization-scoped providers are not affected due to enforced membership and role checks. The issue is fixed in version 1.7.0-beta.4 and later, which makes owner binding mandatory and removes the providerOwnership option. The 1.6.x stable line remains unpatched. Join the discussion | GCVE Database | 07/07/2026, 20:57:05 UTC Added: 07/08/2026, 13:21:59 UTC |
Showing 1 to 1 of 1 result