@better-auth/scim plugin does not bind non-organization SCIM providers to their creator by default, allowing any authenticated user to access and manage another user's non-org provider. The access control check only denies access if a stored owner ID exists and differs from the caller, but since the default is no owner ID, access is granted. This flaw enables attackers to regenerate SCIM bearer tokens for another user's provider, invalidating the legitimate token and gaining unauthorized access. The vulnerability affects all stable releases from 1.5.0 onward and pre-release builds through 1.7.0-beta.3. The fix in 1.7.0-beta.4 enforces mandatory owner binding and requires a schema migration. The 1.6.x stable line is not patched. Workarounds include enabling providerOwnership: { enabled: true } and running the schema migration.

An attacker with any authenticated user account on a deployment using the vulnerable @better-auth/scim plugin can take over another user's non-organization SCIM provider by regenerating its SCIM bearer token. This results in the legitimate user's token being invalidated and the attacker gaining full management access to the provider, including reading metadata, listing connections, and deleting the provider. This compromises confidentiality and integrity of the SCIM provider's data and access. The vulnerability does not require organization membership or elevated roles and affects multi-user deployments using non-org providers without owner binding enabled.

Upgrade to @better-auth/scim version 1.7.0-beta.4 or later (including 1.7.0), which enforces mandatory owner binding and removes the providerOwnership option. After upgrading, run the schema migration using 'npx auth migrate' to add the permanent scimProvider.userId column. For connections created before the upgrade that lack an owner, manually reclaim them by deleting or assigning ownership at the database level and regenerating tokens. If upgrading is not immediately possible, enable providerOwnership: { enabled: true } when registering the plugin and run the schema migration as a temporary workaround. Note that the 1.6.x stable line is not patched.