Critical Better Auth SCIM Flaw Enables Takeover

A critical vulnerability, identified as GHSA-rjg6-39jm-rgg4, affects the @better-auth/scim plugin used in Better Auth implementations. The flaw allows authenticated users to generate SCIM tokens that collide with existing SSO, SAML, OIDC, or social provider accounts, potentially leading to unauthorized account takeover and improper deprovisioning.

What's at Risk

The vulnerability affects users of the @better-auth/scim package. Specifically, versions from 1.4.0-beta.27 through 1.6.21 are vulnerable, as are beta versions from 1.7.0-beta.0 through 1.7.0-beta.9. Organizations that have integrated this plugin and permit authenticated users to generate SCIM tokens are at risk.

This issue is particularly relevant for applications utilizing SSO or external identity providers where account rows are linked to custom provider IDs. Because the SCIM token acts as a gateway to managing user identity, the ability to manipulate these associations poses a severe risk to system integrity and user account security.

How the Flaw Works

Vulnerabilities involving provider ID collisions typically occur when a system fails to maintain clear boundaries between different namespaces or authentication sources. When an application uses the same identifier for both SCIM configuration and internal account ownership, an attacker might be able to influence the authorization logic by injecting or selecting specific identifiers.

In general terms, this class of flaw allows an attacker to masquerade as a legitimate service or user. By tricking the application into associating an attacker-controlled token with an existing user's record, the application may inadvertently grant the attacker administrative or management privileges over that user's data. Furthermore, failures in input validation during update operations—such as failing to verify unique email addresses or failing to correctly process account status changes—can lead to persistent unauthorized access or identity fragmentation.

How to Protect Your Systems

• Upgrade immediately to @better-auth/scim version 1.6.22 or 1.7.0-beta.10 to resolve the collision and validation issues.
• Review your application's canGenerateToken policy to ensure it explicitly rejects provider IDs that are already in use by other account providers.
• Conduct a security audit of your SCIM implementation to ensure that account deprovisioning and email updates are correctly validated against existing user records.
• Restrict the ability to generate SCIM tokens to a limited set of trusted administrative users rather than allowing general authenticated users to perform these actions.
• Monitor application logs for unusual SCIM activity, particularly any attempts to modify user attributes or account statuses that do not align with expected provisioning workflows.

Given the CVSS score of 9.9, this vulnerability represents a significant risk to the authentication layer of any affected application. Promptly applying the provided patches is the most effective way to mitigate the risk of account takeover and ensure that identity management remains secure.