@Better-Auth/Scim

An authorization bypass vulnerability in @better-auth/scim allows authenticated users to mint tokens that collide with provider IDs, enabling unauthorized modification and takeover of global user accounts.

The `@better-auth/scim` package is affected by multiple vulnerabilities, including a critical provider-ID collision flaw that allows authenticated users to craft SCIM tokens impersonating existing account providers, leading to unauthorized account access, profile modification, and user deletion, while additional issues include failed user deactivation and email update vulnerabilities bypassing uniqueness checks in versions `1.4.0-beta.27` through `1.6.21` and `1.7.0-beta.0` through `1.7.0-beta.9`.