GHSA-rjg6-39jm-rgg4: @better-auth/scim Account Takeover And Stale Access Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rjg6-39jm-rgg4",
  "modified" : "2026-07-24T15:40:54Z",
  "published" : "2026-07-24T15:40:54Z",
  "aliases" : [ ],
  "summary" : "@better-auth/scim: account takeover and stale access via SCIM provider-id collision",
  "details" : "### Am I affected?\n\nYou are affected if your application registers the `@better-auth/scim` plugin and lets authenticated users generate SCIM tokens. The default `canGenerateToken` policy was affected, and custom policies were affected when they did not reject provider IDs already used by other account providers. The provider-ID collision issue additionally requires SSO, SAML, OIDC, generic OAuth, or social providers whose account rows use custom provider IDs, plus existing account rows under those IDs.\n\nThe deprovisioning and email-update issues require only the SCIM plugin and a valid SCIM bearer token. Published versions from `@better-auth/scim@1.4.0-beta.27` through `1.6.21` are affected. Beta versions from `1.7.0-beta.0` through `1.7.0-beta.9` are affected. Upgrade to `@better-auth/scim@1.6.22` or `1.7.0-beta.10`.\n\n### Summary\n\n`@better-auth/scim` used the same logical provider ID for SCIM provider configuration and account ownership. SCIM token issuance did not reject all account-provider namespaces. An authenticated user could therefore mint a SCIM token whose provider ID matched an existing SSO, SAML, OIDC, generic OAuth, or social provider. SCIM user routes then selected account rows by that provider ID and treated those users as SCIM-managed, even when the SCIM token had never provisioned them.\n\nThe same write path had 2 additional validation issues. First, SCIM `active: false` was not modeled, so identity providers could receive a successful response while the user stayed active. Second, SCIM PUT and PATCH updates changed global email addresses without the same uniqueness check used by create, and `emailVerified` stayed unchanged after an email reassignment.\n\n### Details\n\nThe SCIM bearer middleware decoded the provider ID from the bearer token and loaded the matching `scimProvider` row. User listing and user lookup then queried ordinary account rows by `account.providerId`. This made the provider ID a user-controlled authorization key. If a SCIM token used a provider ID that belonged to SSO, SAML, OIDC, generic OAuth, or another account provider, the SCIM routes could resolve users that the token did not own.\n\nThe highest-impact path was non-organization deletion. On affected versions, `DELETE /scim/v2/Users/:id` for a non-organization SCIM token deleted the global Better Auth user and their sessions after resolving the user through the colliding provider ID. A low-privileged authenticated user could therefore delete users associated with a colliding provider namespace.\n\nOrganization-scoped tokens were also affected by the provider-ID collision. If the colliding provider ID matched the organization's SSO or OIDC connection, SCIM PUT or PATCH could resolve an SSO-provisioned organization member and rewrite global profile fields. Before the patch, changing a user's email through SCIM skipped the uniqueness check and left `emailVerified` unchanged.\n\nSCIM deactivation had a separate failure mode. The SCIM `active` attribute was missing from the user schemas and PATCH mapping, so `active: false` was stripped from requests. A standard identity-provider deactivation signal could return success while the user kept their identity, sessions, and access.\n\n### Patches\n\nFixed in `@better-auth/scim@1.6.22` and `@better-auth/scim@1.7.0-beta.10`.\n\nThe patch rejects SCIM provider IDs that collide with built-in providers, configured social providers, generic OAuth providers, and SSO provider rows before a token is minted. It also scopes SCIM deletion to the SCIM account link when the user has other identities. The global user is deleted only when the SCIM account is the user's sole linked account.\n\nThe patch models the SCIM `active` attribute. App-level SCIM deactivation maps `active: false` to the admin plugin's enforced disabled-user state and revokes sessions. If the admin plugin is absent, the request is rejected instead of being silently dropped.\n\nThe patch adds the email uniqueness check to SCIM PUT and PATCH updates and resets `emailVerified` whenever SCIM changes a user's email.\n\n### Workarounds\n\nIf you cannot upgrade immediately, configure `canGenerateToken` to reject provider IDs that match any account provider ID used by your application. Include built-in providers, social providers, generic OAuth providers, SSO, SAML, and OIDC provider IDs. Also restrict which users can generate SCIM tokens.\n\nDo not rely on deactivation reports from your identity provider until you have upgraded. Confirm that deactivated users have actually lost access, especially if your identity provider deprovisions through `active: false`.\n\nIf you use SCIM account linking, avoid broad domain-based linking rules. A shared email domain is not proof that a SCIM token may manage a pre-existing user. Prefer organization-membership checks or an explicit application predicate.\n\nAudit existing `scimProvider` rows and remove any row whose `providerId` matches another account provider namespace.\n\n### Impact\n\nWith the provider-ID collision issue, an authenticated attacker could act through a provider namespace they did not own. They could list and read SCIM user resources for users linked to the colliding provider. They could also update profile and account fields and delete global user records on the non-organization path. In organization-scoped deployments, a colliding token could mutate global profile fields for SSO-provisioned organization members.\n\nWith the deactivation issue, a terminated user could remain active after an identity provider reported successful deprovisioning through `active: false`. With the email-update issue, SCIM could assign one user's email to another user on adapters without an enforced unique index. That could corrupt email-keyed login and lookup, while SQL adapters could raise an unhandled adapter error.\n\n### Credit\n\nFound through internal validation.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@better-auth/scim"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.4.0-beta.27"
      }, {
        "fixed" : "1.6.22"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.6.21"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@better-auth/scim"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.7.0-beta.0"
      }, {
        "fixed" : "1.7.0-beta.10"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.7.0-beta.9"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/better-auth/better-auth/pull/10242"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/better-auth/better-auth/commit/7c126dcd1aad24468ec37e876545c1d083d8acca"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/better-auth/better-auth"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/better-auth/better-auth/releases/tag/v1.6.22"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/better-auth/better-auth/releases/tag/v1.7.0-beta.10"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-20", "CWE-639", "CWE-862" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-24T15:40:54Z",
    "nvd_published_at" : null
  }
}