3vulnerabilities
- Critical1 (33.3%)
- High1 (33.3%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low1 (33.3%)
better-auth-scim
Ecosystem: npm
Downloads: 1.59 Mln
- 1CriticalAffects 2 versions
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 1LowAffects 1 version
Monthly breakdown
- 3 vulnerabilities
- Critical: 1
- High: 1
- Medium: 0
- Moderate: 0
- Low: 1
Vulnerabilities (3)
Known vulnerabilities affecting better-auth-scim, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-rjg6-39jm-rgg4 | Critical | @better-auth/scim: account takeover and stale access via SCIM provider-id collision### Am I affected? You are affected if your application registers the `@better-auth/scim` plugin and lets authenticated users generate SCIM tokens. The default `canGenerateToken` policy was affected, and custom policies were affected when they did not reject provider IDs already used by other account providers. The provider-ID collision issue additionally requires SSO, SAML, OIDC, generic OAuth, or social providers whose account rows use custom provider IDs, plus existing account rows under those IDs. The deprovisioning and email-update issues require only the SCIM plugin and a valid SCIM be |
| GitHub (opens in a new tab) | |
| GHSA-2vg6-77g8-24mp | Low | Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows### Am I affected? Users are affected if all of the following are true: - They configure `secondaryStorage` on `betterAuth(...)` (Redis, KV, or any external session cache). - `session.storeSessionInDatabase` is left unset or set to `false` (the default). - Their application's deployment uses one or more of: - The `admin` plugin and calls `auth.api.removeUser(...)` or `authClient.admin.removeUser(...)`. - The `anonymous` plugin and exposes `/delete-anonymous-user` or relies on the after-link hook to clean up the anonymous user. - The `@better-auth/scim` plugin and exposes `DELETE /scim/ |
| GitHub (opens in a new tab) | |
| GHSA-j8v8-g9cx-5qf4 | High | @better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers### Am I affected? Users are affected if all of these hold: - They install and register the `@better-auth/scim` plugin (`plugins: [scim()]`). - They create SCIM providers without an `organizationId`, that is, non-organization ("personal") providers. Organization-scoped providers are not affected because they enforce organization membership and role. - Their application's deployment has more than one authenticated user, so one account can target another user's provider. - They have not set `providerOwnership: { enabled: true }`. The SCIM management endpoints first shipped in `1.5.0`, so ever |
| GitHub (opens in a new tab) |
- GHSA-rjg6-39jm-rgg4Critical@better-auth/scim: account takeover and stale access via SCIM provider-id collision
>= 1.4.0-beta.27, < 1.6.22>= 1.7.0-beta.0, < 1.7.0-beta.10
### Am I affected? You are affected if your application registers the `@better-auth/scim` plugin and lets authenticated users generate SCIM tokens. The default `canGenerateToken` policy was affected, and custom policies were affected when they did not reject provider IDs already used by other account providers. The provider-ID collision issue additionally requires SSO, SAML, OIDC, generic OAuth, or social providers whose account rows use custom provider IDs, plus existing account rows under those IDs. The deprovisioning and email-update issues require only the SCIM plugin and a valid SCIM be
CVE: CVE-2026-67330
- GHSA-2vg6-77g8-24mpLowBetter Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
>= 1.6.0, < 1.6.11
### Am I affected? Users are affected if all of the following are true: - They configure `secondaryStorage` on `betterAuth(...)` (Redis, KV, or any external session cache). - `session.storeSessionInDatabase` is left unset or set to `false` (the default). - Their application's deployment uses one or more of: - The `admin` plugin and calls `auth.api.removeUser(...)` or `authClient.admin.removeUser(...)`. - The `anonymous` plugin and exposes `/delete-anonymous-user` or relies on the after-link hook to clean up the anonymous user. - The `@better-auth/scim` plugin and exposes `DELETE /scim/
CVE: CVE-2026-67334
- GHSA-j8v8-g9cx-5qf4High@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers
>= 1.5.0, < 1.7.0-beta.4
### Am I affected? Users are affected if all of these hold: - They install and register the `@better-auth/scim` plugin (`plugins: [scim()]`). - They create SCIM providers without an `organizationId`, that is, non-organization ("personal") providers. Organization-scoped providers are not affected because they enforce organization membership and role. - Their application's deployment has more than one authenticated user, so one account can target another user's provider. - They have not set `providerOwnership: { enabled: true }`. The SCIM management endpoints first shipped in `1.5.0`, so ever
CVE: CVE-2026-67331