better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 have an authorization bypass vulnerability where non-organization SCIM providers are not properly bound to their creators. This flaw allows authenticated users to manipulate other users' SCIM providers, including regenerating bearer tokens and authenticating with tokens controlled by the attacker. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

An attacker with authenticated access can manage SCIM providers of other users, regenerate bearer tokens, invalidate legitimate tokens, and gain unauthorized access to SCIM API routes. This could lead to unauthorized access and control over user provisioning and management functions exposed via SCIM.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to limit access to SCIM provider management and monitor for suspicious token regeneration activities.