This issue allows any authenticated user within the application to perform administrative actions on SCIM providers owned by other users. The impact is significant, as an attacker can list, modify, or delete existing providers, invalidate legitimate SCIM bearer tokens, and generate new tokens under the context of the victim's provider configuration. This effectively permits an attacker to perform account takeover or unauthorized data synchronization by intercepting or manipulating SCIM API traffic. Organizations using affected versions are advised to upgrade to 1.7.0-beta.4 or later immediately.

Impact

Successful exploitation allows unauthorized users to fully control the SCIM integration lifecycle of other users within the platform. This leads to the compromise of identity synchronization processes, potential unauthorized provisioning or deprovisioning of accounts, and the ability to exfiltrate or modify sensitive identity data transmitted through SCIM. The vulnerability has a CVSS v3.1 base score of 8.3, reflecting the high risk to confidentiality and integrity in enterprise environments relying on SCIM for user lifecycle management.

Recommendation

• Upgrade the better-auth SCIM package to version 1.7.0-beta.4 or higher to resolve the authorization logic flaw documented in CVE-2026-67331.
• Audit existing SCIM provider configurations in your environment to identify any unauthorized provider objects or unexpected token changes.
• Review web access logs for anomalous API activity directed at SCIM endpoints, specifically looking for repeated modifications of token resources by non-administrative users.