Scim
Monthly
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully take over another user's non-organization SCIM provider by exploiting a missing ownership binding. The root flaw (CWE-639) means provider rows are created without a userId by default, causing the access check to pass silently for any caller. An attacker with a valid session can regenerate a victim's SCIM bearer token, invalidating the legitimate token and authenticating to SCIM API routes with the attacker-controlled credential. No public exploit or KEV listing is confirmed at time of analysis, but the CVSS 4.0 score of 8.7 reflects the low exploitation complexity for any authenticated user.
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9) lets an authenticated low-privileged user mint a SCIM bearer token whose provider ID collides with an existing SSO, SAML, OIDC, generic OAuth, or social provider namespace, causing SCIM user routes to operate on global accounts the token never provisioned. Attackers can list, read, rewrite (email/profile with no uniqueness check), and delete arbitrary Better Auth users and sessions, yielding full account takeover and unauthorized deprovisioning. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor's detailed root-cause writeup makes exploitation straightforward once the plugin is enabled.
An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authorization bypass in @better-auth/scim versions 1.5.0 through 1.7.0-beta.3 allows any authenticated user to fully take over another user's non-organization SCIM provider by exploiting a missing ownership binding. The root flaw (CWE-639) means provider rows are created without a userId by default, causing the access check to pass silently for any caller. An attacker with a valid session can regenerate a victim's SCIM bearer token, invalidating the legitimate token and authenticating to SCIM API routes with the attacker-controlled credential. No public exploit or KEV listing is confirmed at time of analysis, but the CVSS 4.0 score of 8.7 reflects the low exploitation complexity for any authenticated user.
Privilege-escalating account takeover in the @better-auth/scim plugin (versions 1.4.0-beta.27 through 1.6.21 and 1.7.0-beta.0 through 1.7.0-beta.9) lets an authenticated low-privileged user mint a SCIM bearer token whose provider ID collides with an existing SSO, SAML, OIDC, generic OAuth, or social provider namespace, causing SCIM user routes to operate on global accounts the token never provisioned. Attackers can list, read, rewrite (email/profile with no uniqueness check), and delete arbitrary Better Auth users and sessions, yielding full account takeover and unauthorized deprovisioning. No public exploit is identified at time of analysis and it is not in CISA KEV, but the vendor's detailed root-cause writeup makes exploitation straightforward once the plugin is enabled.
An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.