Executive brief
Better Auth's SCIM plugin manages identity provider integrations for organizations. By default, non-organizational SCIM providers lack owner validation, allowing any authenticated user in a multi-user deployment to read, regenerate tokens for, and effectively take control of another user's provider. This enables account takeover and provider impersonation without elevated privileges.
Technical details
The vulnerability is an authorization bypass in the @better-auth/scim plugin affecting non-organization SCIM providers. The access control check for SCIM management operations (token generation/regeneration, provider reads, deletions) is flawed: it only denies access when a stored userId exists AND differs from the caller. By default, the scimProvider.userId column is unset and the providerOwnership option is disabled, so the check passes for all authenticated users. This affects all management endpoints reachable through the public API. The most critical impact is token regeneration: an attacker can regenerate a provider's SCIM bearer token, invalidating the legitimate owner's token and gaining authentication to that provider's SCIM API routes. The attack requires multiple authenticated users in the deployment and is not exploitable in single-tenant scenarios. Patches are available in @better-auth/scim@1.7.0-beta.4 and later, which make owner binding mandatory.
Affected products
- Better Auth @better-auth/scim 1.5.0 through 1.7.0-beta.3
Timeline
- 2026-07-07: disclosed
- 2026-07-07: patched: 1.7.0-beta.4 released with fix; 1.7.0 stable to follow