CyberRota Analysis
AI-GeneratedVersions of the @better-auth/scim plugin from 1.4.0-beta.27 to 1.6.21 and from 1.7.0-beta.0 to 1.7.0-beta.9 are vulnerable to an authorization bypass that allows authenticated users to exploit SCIM token issuance. This flaw enables attackers to access, modify, or delete global user accounts and sessions, potentially leading to account takeover and unauthorized deprovisioning. Organizations using affected versions should prioritize immediate updates to versions 1.6.22 or 1.7.0-beta.10 (or later) to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).