Executive brief
The better-auth SCIM plugin, used to manage user accounts via the SCIM protocol, fails to properly validate provider IDs when issuing access tokens. An authenticated attacker can mint a token with a provider ID matching an existing SSO, OIDC, or social login provider, then use that token to read, modify, or delete user accounts belonging to other providers—effectively taking over those accounts or disabling access. Organizations using SCIM for identity management and SSO are at risk of user account compromise.
Technical details
The vulnerability is an authorization bypass in the SCIM plugin caused by using the same provider ID namespace for both SCIM configuration and account ownership without collision detection. The SCIM bearer token middleware decodes a provider ID from the token, and user lookup queries account rows by that provider ID without verifying the token owns that namespace. An authenticated user can generate a SCIM token with a provider ID matching an existing SSO, SAML, OIDC, OAuth, or social provider, allowing them to list, read, update, and delete user accounts linked to that provider. Related issues include missing validation of the SCIM active attribute (allowing deactivation requests to succeed silently while users remain active) and insufficient email uniqueness checks in SCIM PATCH/PUT operations. Network-reachable; requires an authenticated user to generate the malicious token. Patches available in @better-auth/scim@1.6.22 and 1.7.0-rc.0 and later.
Affected products
- better-auth SCIM 1.4.0-beta.27 through 1.6.21, 1.7.0-beta.0 through 1.7.0-beta.9
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: Fixed in @better-auth/scim@1.6.22 and 1.7.0-rc.0