Product
6 published CVES affecting better-auth @better-auth/scim, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up...
better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authent...
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social acc...
Am I affected? You are affected if your application registers the @better-auth/scim plugin and lets authenticated users generate SCIM tokens. The default canGenerateToken policy was affected, and custom policies were affected when they did not reject provider IDs already used by...
Am I affected? Users are affected if all of these hold: They install and register the @better-auth/scim plugin (plugins: [scim()]). They create SCIM providers without an organizationId, that is, non-organization ("personal") providers. Organization-scoped providers are not affect...
Am I affected? Users are affected if all of the following are true: They configure secondaryStorage on betterAuth(...) (Redis, KV, or any external session cache). session.storeSessionInDatabase is left unset or set to false (the default). Their application's deployment uses one o...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.