An authorization bypass vulnerability in the better-auth SCIM component allows authenticated users to perform unauthorized actions by manipulating specific keys.

This vulnerability is categorized as CWE-639, an authorization bypass through user-controlled keys. The attacker must have a low level of privileges to exploit this flaw, which occurs within the SCIM (System for Cross-domain Identity Management) implementation.

By exploiting this authorization flaw, an attacker with basic user access can elevate their privileges or access resources they are not authorized to view or modify. This undermines the principle of least privilege and could lead to unauthorized data manipulation or exposure within the identity management ecosystem. The CVSS score of 8.3 indicates high risk to the confidentiality and integrity of the system.

Immediate Action: Update the @better-auth/scim npm package to version 1.7.0-beta.4 to ensure proper authorization checks are enforced.

Proactive Monitoring: Review SCIM-related access logs for unauthorized attempts to access or modify resources that fall outside the user's assigned scope.

Compensating Controls: Implement strict identity and access management policies that limit the scope of SCIM operations until the update can be applied.

Public Exploit Available: No

Organizations relying on the better-auth SCIM integration must prioritize the update to version 1.7.0-beta.4. Failure to patch this vulnerability leaves the identity management system susceptible to unauthorized access and privilege escalation.