A critical authorization bypass in the better-auth scim plugin allows authenticated users to perform unauthorized account takeovers and data manipulation across global user accounts.

The flaw stems from improper input validation where SCIM token issuance fails to isolate provider IDs. An authenticated user can leverage these collisions to assume control over global user profiles and sessions, bypassing standard security boundaries.

The ability to manipulate global user accounts and sessions poses a severe threat to user privacy and system integrity. Successful exploitation leads to full account takeover, unauthorized data access, and the potential for malicious deprovisioning of users. The CVSS score of 9.9 underscores the extreme risk of unauthorized administrative-level access within the application.

Immediate Action: Update the @better-auth/scim plugin to version 1.6.22 or 1.7.0-rc.0 (or later) to resolve the provider ID collision vulnerability.

Proactive Monitoring: Audit logs for suspicious SCIM token issuance requests or unauthorized modifications to user profile fields, such as email address changes or unusual account deprovisioning events.

Compensating Controls: Implement strict identity provider (IdP) segregation and ensure that SCIM provisioning endpoints are restricted to trusted and authorized service principals only.

Public Exploit Available: No (Exploit available: unknown)

Given the potential for complete account takeover, this vulnerability requires immediate attention. Administrators must verify their current plugin versions and apply the specified patches to prevent unauthorized access to user data.