{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/@better-auth/scim/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@better-auth/scim"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","web-application","account-takeover","sso"],"_cs_type":"advisory","_cs_vendors":["better-auth"],"content_html":"\u003cp\u003eThe \u003ccode\u003e@better-auth/scim\u003c/code\u003e plugin, utilized by applications registering it, is critically vulnerable to multiple flaws, including a provider-ID collision issue (GHSA-rjg6-39jm-rgg4). This vulnerability, affecting versions from \u003ccode\u003e1.4.0-beta.27\u003c/code\u003e through \u003ccode\u003e1.6.21\u003c/code\u003e and \u003ccode\u003e1.7.0-beta.0\u003c/code\u003e through \u003ccode\u003e1.7.0-beta.9\u003c/code\u003e, allows an authenticated attacker to craft SCIM tokens whose \u003ccode\u003eproviderId\u003c/code\u003e matches an existing SSO, SAML, OIDC, or social provider. This enables unauthorized account access, modification of profile fields, and complete deletion of user accounts not managed by the SCIM token. Additionally, the plugin fails to correctly process \u003ccode\u003eactive: false\u003c/code\u003e deactivation requests, potentially leaving terminated users with continued access, and bypasses email uniqueness checks during updates, leading to data corruption. These issues could lead to significant security breaches, including widespread account takeovers and denial of service for legitimate users.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated user accesses an application integrated with \u003ccode\u003e@better-auth/scim\u003c/code\u003e and generates a SCIM bearer token, leveraging either the default \u003ccode\u003ecanGenerateToken\u003c/code\u003e policy or a custom policy vulnerable to \u003ccode\u003eproviderId\u003c/code\u003e collision.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a legitimate \u003ccode\u003eproviderId\u003c/code\u003e (e.g., from an SSO, SAML, OIDC, or social provider) already in use by other account rows within the application's database.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts the SCIM bearer token or modifies its \u003ccode\u003eproviderId\u003c/code\u003e to explicitly collide with this identified legitimate \u003ccode\u003eproviderId\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUsing this maliciously crafted SCIM token, the attacker sends a \u003ccode\u003eDELETE /scim/v2/Users/:id\u003c/code\u003e API request to the application, targeting a specific user ID.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e@better-auth/scim\u003c/code\u003e plugin, due to the \u003ccode\u003eproviderId\u003c/code\u003e collision, incorrectly maps the request to a global user account associated with the legitimate, colliding provider, even if the SCIM token never provisioned that user.\u003c/li\u003e\n\u003cli\u003eThe application proceeds to delete the global user and their associated sessions, leading to unauthorized account access removal and denial of service for the legitimate user.\u003c/li\u003e\n\u003cli\u003eAlternatively, the attacker could use \u003ccode\u003ePUT\u003c/code\u003e or \u003ccode\u003ePATCH\u003c/code\u003e requests with the crafted token to rewrite global profile fields for SSO-provisioned organization members by leveraging the \u003ccode\u003eproviderId\u003c/code\u003e collision.\u003c/li\u003e\n\u003cli\u003eFurther exploitation includes leveraging the absence of email uniqueness checks in \u003ccode\u003ePUT\u003c/code\u003e or \u003ccode\u003ePATCH\u003c/code\u003e updates to assign one user's email to another, potentially corrupting user login and lookup capabilities.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe provider-ID collision issue allows an authenticated attacker to gain unauthorized access to and manipulate user accounts not under the SCIM token's legitimate scope. Attackers can delete global user records, modify profile information for SSO-provisioned organization members, and potentially corrupt email-keyed login data by reassigning email addresses without uniqueness checks. The deactivation flaw means terminated users might retain access, as the \u003ccode\u003eactive: false\u003c/code\u003e attribute is ignored, allowing continued presence in the system even after an identity provider signals deprovisioning. These vulnerabilities pose a critical risk of widespread account takeover, denial of service, and data integrity issues for affected applications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade \u003ccode\u003e@better-auth/scim\u003c/code\u003e to version \u003ccode\u003e1.6.22\u003c/code\u003e or \u003ccode\u003e1.7.0-beta.10\u003c/code\u003e to address the \u003ccode\u003eproviderId\u003c/code\u003e collision, deactivation, and email update vulnerabilities.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, configure the \u003ccode\u003ecanGenerateToken\u003c/code\u003e policy to explicitly reject \u003ccode\u003eproviderId\u003c/code\u003e values that match any existing built-in, social, generic OAuth, SSO, SAML, or OIDC account provider IDs in your application.\u003c/li\u003e\n\u003cli\u003eRestrict the generation of SCIM tokens to only trusted, privileged users to limit exposure to these vulnerabilities.\u003c/li\u003e\n\u003cli\u003eAudit existing \u003ccode\u003escimProvider\u003c/code\u003e rows in your application and remove any rows whose \u003ccode\u003eproviderId\u003c/code\u003e matches another existing account provider namespace.\u003c/li\u003e\n\u003cli\u003eAvoid relying solely on deactivation reports from your identity provider; manually confirm that deactivated users have lost access, particularly if your identity provider uses \u003ccode\u003eactive: false\u003c/code\u003e for deprovisioning.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T15:42:07Z","date_published":"2026-07-24T15:42:07Z","id":"https://feed.craftedsignal.io/briefs/2026-07-better-auth-scim-collision/","summary":"The `@better-auth/scim` package is affected by multiple vulnerabilities, including a critical provider-ID collision flaw that allows authenticated users to craft SCIM tokens impersonating existing account providers, leading to unauthorized account access, profile modification, and user deletion, while additional issues include failed user deactivation and email update vulnerabilities bypassing uniqueness checks in versions `1.4.0-beta.27` through `1.6.21` and `1.7.0-beta.0` through `1.7.0-beta.9`.","title":"Account Takeover and Stale Access via SCIM Provider-ID Collision in @better-auth/scim","url":"https://feed.craftedsignal.io/briefs/2026-07-better-auth-scim-collision/"}],"language":"en","title":"CraftedSignal Threat Feed - @Better-Auth/Scim","version":"https://jsonfeed.org/version/1.1"}