Homepage

@better-auth/scim@1.6.3

SCIM plugin for Better Auth

  • latest version

    1.6.27

  • latest non vulnerable version

    1.7.0-rc.4

  • first published

    8 months ago

  • latest version published

    3 hours ago

  • licenses detected

  • View scim package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @better-auth/scim package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Authorization Bypass Through User-Controlled Key

    @better-auth/scim is a SCIM plugin for Better Auth

    Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via SCIM token issuance and user resolution in the SCIM routes. An authenticated user can act on SCIM-managed accounts owned by another provider namespace by minting or using a SCIM token whose provider ID matches an existing SSO, SAML, OIDC, OAuth, or social provider ID. This lets the attacker list, update, or delete users they do not own, which can lead to account takeover, user deletion, and loss of access for affected users.

    Notes

    • In the non-organization delete path, the vulnerable behavior removed the entire global user record when the SCIM token’s provider matched, even if that user also had other linked identities. That makes the impact broader in deployments that link SCIM-provisioned accounts to password, social, or SSO logins, because a SCIM deletion could tear down the user’s other access paths too.

    • The issue is only reachable where authenticated users are allowed to mint SCIM tokens and where account rows under colliding provider IDs already exist. The maintainer's advisory calls out custom provider IDs for SSO/SAML/OIDC/generic OAuth/social providers as the collision source; default provider IDs without that namespace overlap are not the problematic case.

    Workarounds

    • Configure canGenerateToken to reject SCIM provider IDs that match any provider namespace already used by your app, including built-in providers, social providers, generic OAuth providers, SSO, SAML, and OIDC; this blocks the provider-id collision used to mint unauthorized SCIM tokens.
    • Restrict which authenticated users can generate SCIM tokens; this reduces the chance that a low-privileged user can obtain a token for a colliding provider namespace.
    • Audit existing scimProvider rows and remove any row whose providerId matches another account provider namespace; this prevents existing colliding SCIM providers from being used for unauthorized user resolution.
    • Do not rely on active: false deprovisioning reports from your identity provider until after upgrading; verify that deactivated users have actually lost access, especially if your IdP signals deprovisioning through SCIM active: false.
    • If you use SCIM account linking, avoid broad domain-based linking rules; prefer organization-membership checks or an explicit application predicate so a shared email domain cannot be used to manage a pre-existing user.

    How to fix Authorization Bypass Through User-Controlled Key?

    Upgrade @better-auth/scim to version 1.6.22, 1.7.0-beta.10 or higher.

    <1.6.22>=1.7.0-beta.0 <1.7.0-beta.10
    • H
    Missing Authorization

    @better-auth/scim is a SCIM plugin for Better Auth

    Affected versions of this package are vulnerable to Missing Authorization in the management of non-organization SCIM providers when owner binding is not enforced. An attacker can gain unauthorized access to another user's provider, allowing them to read metadata, list connections, regenerate SCIM bearer tokens (invalidating the legitimate user's token), authenticate to SCIM API routes, manage provisioned users, and delete provider connections by sending crafted requests to the management endpoints.

    Note: This is only exploitable if the plugin is configured with its default ownership settings, non-organization providers are used, and there is more than one authenticated user in the application.

    How to fix Missing Authorization?

    Upgrade @better-auth/scim to version 1.6.11 or higher.

    >=1.5.0 <1.6.11
    • M
    Operation on a Resource after Expiration or Release

    @better-auth/scim is a SCIM plugin for Better Auth

    Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release in the deleteUser method when secondaryStorage is configured and session.storeSessionInDatabase is unset or set to false. An attacker can retain access to resources and perform actions as a deleted user by using a valid session token that remains active until its TTL expires.

    Note: This is only exploitable if secondaryStorage is enabled and session.storeSessionInDatabase is not set to true.

    How to fix Operation on a Resource after Expiration or Release?

    Upgrade @better-auth/scim to version 1.6.11 or higher.

    >=1.6.0 <1.6.11
    Go back to all versions of this package