The @better-auth/scim plugin versions from 1.5.0 onward have a vulnerability affecting non-organization (personal) SCIM providers when the providerOwnership option is not enabled. This allows any authenticated user in a multi-user deployment to manage another user's non-org SCIM provider, including reading metadata, listing connections, regenerating SCIM bearer tokens, and deleting connections. Regenerating a token invalidates the legitimate user's token and grants the attacker a valid token, enabling account/provider takeover. Organization-scoped providers are not affected due to enforced membership and role checks. The issue is fixed in version 1.7.0-beta.4 and later, which makes owner binding mandatory and removes the providerOwnership option. The 1.6.x stable line remains unpatched.