@better-auth/scim versions >=1.4.0-beta.27 <=1.6.21 and >=1.7.0-beta.0 <=1.7.0-beta.9 contain an authorization bypass due to improper input validation on SCIM token issuance. The SCIM token issuance process fails to reject provider IDs that collide with existing SSO, SAML, OIDC, OAuth, or social account providers. Because the same logical provider ID is used for both SCIM provider configuration and account ownership, an authenticated user can mint a SCIM token with a provider ID that conflicts with an existing provider namespace. This causes SCIM user routes to resolve account data for accounts the token never provisioned, allowing unauthorized listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting of user accounts and sessions. The impact includes account takeover and unauthorized deprovisioning. The issue is fixed in versions 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).

An authenticated user can exploit this vulnerability to bypass authorization controls, allowing them to list, read, update, and delete global user accounts and sessions that they do not own. This can lead to account takeover and unauthorized deprovisioning of user accounts, compromising user data integrity and availability.

Upgrade to @better-auth/scim version 1.6.22 or later, or 1.7.0-beta.10 (1.7.0-rc.0) or later, where this vulnerability is fixed. Patch status is confirmed by the vendor's versioning information. No other mitigations are indicated.