---
title: "GHSA-rjg6-39jm-rgg4: @better-auth/scim: account takeover and stale access via SCIM provider-id collision"
url: https://erroneo.us/security/ghsa/GHSA-rjg6-39jm-rgg4/
description: "GHSA-rjg6-39jm-rgg4 (critical, npm): @better-auth/scim: account takeover and stale access via SCIM provider-id collision. Am I affected? You are affected if…"
type: advisory
section: "Security Digest"
date_published: 2026-07-24
date_modified: 2026-07-24
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-rjg6-39jm-rgg4"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-rjg6-39jm-rgg4: @better-auth/scim: account takeover and stale access via SCIM provider-id collision

## Affected packages

- npm `@better-auth/scim` >= 1.4.0-beta.27, <= 1.6.21 → fixed: 1.6.22
- npm `@better-auth/scim` >= 1.7.0-beta.0, <= 1.7.0-beta.9 → fixed: 1.7.0-beta.10

## Details

Am I affected? You are affected if your application registers the @better-auth/scim plugin and lets authenticated users generate SCIM tokens. The default canGenerateToken policy was affected, and custom policies were affected when they did not reject provider IDs already used by other account providers. The provider-ID collision issue additionally requires SSO, SAML, OIDC, generic OAuth, or social providers whose account rows use custom provider IDs, plus existing account rows under those IDs. The deprovisioning and email-update issues require only the SCIM plugin and a valid SCIM bearer token. Published versions from @better-auth/scim@1.4.0-beta.27 through 1.6.21 are affected. Beta versions from 1.7.0-beta.0 through 1.7.0-beta.9 are affected. Upgrade to @better-auth/scim@1.6.22 or 1.7.0-beta.10. Summary @better-auth/scim used the same logical provider ID for SCIM provider configuration and account ownership. SCIM token issuance did not reject all account-provider namespaces. An authenticated user could therefore mint a SCIM token whose provider ID matched an existing SSO, SAML, OIDC, generic OAuth, or social provider. SCIM user routes then selected account rows by that provider ID and treated those users as SCIM-managed, even when the SCIM token had never provisioned them. The same write path had 2 additional validation issues. First, SCIM active: false was not modeled, so identity providers could receive a successful response while the user stayed active. Second, SCIM PUT and PATCH updates changed global email addresses without the same uniqueness check used by create, and emailVerified stayed unchanged after an email reassignment. Details The SCIM bearer middleware decoded the provider ID from the bearer token and loaded the matching scimProvider row. User listing and user lookup then queried ordinary account rows by account.providerId. This made the provider ID a user-controlled authorization key. If a SCIM token used a provider ID that belonged to SSO, SAML, OIDC, generic OAuth, or another account provider, the SCIM routes could resolve users that the token did not own. The highest-impact path was non-organization deletion. On affected versions, DELETE /scim/v2/Users/:id for a non-organization SCIM token deleted the global Better Auth user and their sessions after resolving the user through the colliding…

## Sources

- [GitHub Advisory GHSA-rjg6-39jm-rgg4](https://github.com/advisories/GHSA-rjg6-39jm-rgg4)
- [github.com](https://github.com/better-auth/better-auth/security/advisories/GHSA-rjg6-39jm-rgg4)
- [github.com](https://github.com/better-auth/better-auth/pull/10242)
- [github.com](https://github.com/better-auth/better-auth/commit/7c126dcd1aad24468ec37e876545c1d083d8acca)
- [github.com](https://github.com/better-auth/better-auth/releases/tag/v1.6.22)
- [github.com](https://github.com/better-auth/better-auth/releases/tag/v1.7.0-beta.10)

---
Source page: https://erroneo.us/security/ghsa/GHSA-rjg6-39jm-rgg4/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt