Threats affecting pkg:npm/@better-auth/scim

@better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).

The @better-auth/scim plugin versions from 1.5.0 onward have a vulnerability affecting non-organization (personal) SCIM providers when the providerOwnership option is not enabled. This allows any authenticated user in a multi-user deployment to manage another user's non-org SCIM provider, including reading metadata, listing connections, regenerating SCIM bearer tokens, and deleting connections. Regenerating a token invalidates the legitimate user's token and grants the attacker a valid token, enabling account/provider takeover. Organization-scoped providers are not affected due to enforced membership and role checks. The issue is fixed in version 1.7.0-beta.4 and later, which makes owner binding mandatory and removes the providerOwnership option. The 1.6.x stable line remains unpatched.

A vulnerability in better-auth causes stale user sessions to persist after user deletion when using external session caches and the session is not stored in the database. This affects user deletion flows in the admin, anonymous, and SCIM plugins, allowing deleted users' sessions to remain valid until the session TTL expires (default 7 days). The issue is fixed in patched versions of better-auth and @better-auth/scim, which ensure sessions are deleted before user records. Workarounds include enabling session storage in the database or explicitly revoking sessions in code. The impact is limited to session persistence post-deletion, with no known exploits in the wild.