Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a critical authorization bypass in the @better-auth/scim plugin. The root cause is a provider-ID collision issue, where the system did not prevent the creation of SCIM tokens with provider IDs that were already in use by other authentication providers (SSO, SAML, OIDC, etc.). This allowed an authenticated but low-privileged user to mint a SCIM token that impersonated another provider, granting them unauthorized access to manage users under that provider's namespace.
The analysis of the patch commits reveals several vulnerable functions in packages/scim/src/routes.ts that were exploited as a result of this provider-ID collision:
generateSCIMToken: This is the entry point of the vulnerability. It failed to validate the uniqueness of the provider ID before issuing a token, allowing the provider-ID collision to occur.
deleteSCIMUser: In the vulnerable version, this function would delete the entire global user account. When combined with the provider-ID collision, an attacker could delete any user in the system by crafting a malicious SCIM token.
updateSCIMUser and patchSCIMUser: These functions were also vulnerable. They allowed an attacker to modify user data, including changing a user's email address to one that was already in use, leading to account corruption and potential takeover. They also failed to handle the active: false attribute, causing deactivation signals to be ignored.
createSCIMUser: This function also had a flaw where it would ignore the active: false attribute upon user creation.
The patch addresses these issues by adding the necessary validation and scoping the write operations. Specifically, it introduces checks to prevent provider-ID collisions, modifies deleteSCIMUser to only unlink the SCIM account instead of deleting the global user, and adds email uniqueness checks and active: false handling to the user creation and update functions.
generateSCIMTokenpackages/scim/src/routes.ts
deleteSCIMUserpackages/scim/src/routes.ts
updateSCIMUserpackages/scim/src/routes.ts
patchSCIMUserpackages/scim/src/routes.ts
createSCIMUserpackages/scim/src/routes.ts