Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass

Easy!Appointments correctly filters provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints appointments/store and appointments/update only check generic appointment privileges and...

Missing Authorization

Overview @better-auth/scim is a SCIM plugin for Better Auth Affected versions of this package are vulnerable to Missing Authorization in the management of non-organization SCIM providers when owner binding is not enforced. An attacker can gain unauthorized access to another user's provider,...

GHSA-J8V8-G9CX-5QF4 @better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers

Am I affected? Users are affected if all of these hold: - They install and register the @better-auth/scim plugin plugins: scim. - They create SCIM providers without an organizationId, that is, non-organization "personal" providers. Organization-scoped providers are not affected because they enfor...

PT-2026-67311

Name of the Vulnerable Software and Affected Versions better-auth SCIM versions 1.5.0 through 1.7.0-beta.3 Description By default, the @better-auth/scim plugin fails to bind non-organization personal SCIM providers to their creator. This occurs because the providerOwnership option and the...