The vulnerability in better-auth scim arises from improper input validation where SCIM token issuance does not reject provider IDs already assigned to existing identity providers (SSO, SAML, OIDC, OAuth, social accounts). Because the same logical provider ID is used for both SCIM provider configuration and account ownership, an authenticated user can create a SCIM token with a colliding provider ID. This causes SCIM user routes to resolve account data for accounts the token never provisioned, allowing unauthorized access to list, read, update (including global profile and email fields without uniqueness checks), and delete user accounts and sessions. This results in account takeover and unauthorized deprovisioning. The issue is resolved in versions 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).

An authenticated user can bypass authorization controls by minting SCIM tokens with provider IDs that collide with existing identity providers, enabling unauthorized access to global user accounts and sessions. This includes the ability to list, read, update (including rewriting global profile and email fields without uniqueness checks), and delete accounts and sessions. The impact includes account takeover and unauthorized deprovisioning, representing a critical security risk.

A fix is available in better-auth scim versions 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0). Users should upgrade to these versions or later to remediate this vulnerability. No vendor advisory content is provided to indicate alternative mitigations or temporary workarounds.