EUVD-2026-51810

better-auth before 1.6.13 and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3 fail to validate the scheme of redirecturis registered via the deprecated oidc-provider plugin and the mcp plugin which wraps the same provider. An attacker can register an OAuth client with a javascript:...

CVE-2026-67332 @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...

CVE-2026-67332 @better-auth/oauth-provider before 1.7.0-beta.4 Authorization Bypass

@better-auth/oauth-provider before 1.7.0-beta.4 fails to bind access-token audience to the authorization grant, allowing clients to request tokens for unrelated resources. Attackers can complete an OAuth flow and obtain access tokens whose audience targets resource servers the authorization never...

CVE-2026-67332

Technical details (affected products/versions/mitigation) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-67336 better-auth before 1.6.11 Insecure Cryptographic Defaults via oidcProvider

better-auth versions before 1.6.11 contain insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain...

CVE-2026-67331 better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API...

CVE-2026-67331 better-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API...

CVE-2026-67331

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API...

EUVD-2026-51846

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API...

CVE-2026-67330 better-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision

@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...

EUVD-2026-51859

@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...

CVE-2026-67330

The CVE affects @better-auth/scim (the better-auth SCIM plugin). Versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9 contain an authorization bypass caused by SCIM token issuance using provider IDs that collide with existing SSO/SAML/OIDC/generic OAuth/social provider name...

CVE-2026-67330

@better-auth/scim a better-auth plugin versions = 1.4.0-beta.27 through = 1.7.0-beta.0 through = 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical...

Improper Verification of Cryptographic Signature

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the backchannel logout endpoint of the keycloak-services...

CVE-2026-14541 Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

CVE-2026-14541 Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

Oracle Linux 8 : sssd (ELSA-2026-46990)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-46990 advisory. - Resolves: RHEL-192053 - CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege...

SUSE CVE-2026-47190

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...

CVE-2026-67596 CSL 1010 M2M 3G WiFi Module 2.2.1.4 Weak Encryption via Router.cfg

CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext by reversing a single-byte XOR cipher that uses a static key to obfuscate the configuration backup file. Attackers can...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...