@better-auth/scim Missing Authorization: Authenticated Users Can Hijack Non-Organization SCIM Providers

Vulnerability Overview In the plugin, in single-tenant usage scenarios, authenticated users can regenerate SCIM provider tokens. This vulnerability allows any authenticated user to manage other users' non-organization SCIM providers, including reading their metadata, listing connections, regenerating SCIM provider tokens, and deleting provider connections. Regenerating a token invalidates the previous one, allowing the attacker to hold a valid token. Affected Versions Affected versions: Fixed version: Remediation 1. Upgrade to the fixed version: Upgrade to (this is a breaking change that removes the option, making owner binding mandatory, and adds a permanent column). 2. Run database migration: Run to regenerate SCIM provider tokens and reclaim connections that were created before the upgrade and lacked an owner or became unreachable. 3. Apply workarounds: If remaining on the stable version, apply the following workarounds: - Set when registering the plugin, then run the schema update to ensure the column exists ( ). New non-organization providers will be owner-bound, and non-owners will be denied access. - Scope each SCIM provider to an organization by always passing the . Organization providers enforce membership and roles and will not be exposed. - Restrict access to SCIM management endpoints at the edge while non-organization providers retain ownership. Proof of Concept (POC) Impact Any authenticated user can take over non-organization SCIM providers created by other users. An attacker can discover non-organization provider connections, read provider metadata, regenerate another user's SCIM token (invalidating the legitimate token), authenticate to SCIM API routes using the new token, manage SCIM provisioned users, and delete provider connections. References CVE-862 Missing Authorization CVE-639 Authorization Bypass Through User-Controlled Key SCIM 2.0 Protocol (RFC 7644) OAuth 2.0 Bearer Token Usage (RFC 6750)

Goal Reached Thanks to every supporter — we hit 100%!

@better-auth/scim Missing Authorization: Authenticated Users Can Hijack Non-Organization SCIM Providers

More from this source