This vulnerability allows an authenticated user to influence the creation of a SCIM token such that its provider ID clashes with an existing provider namespace. Because the same logical identifier is used for both the SCIM provider configuration and account ownership, the forged token can resolve to user accounts that were never provisioned by it. The attacker can enumerate, read, update (including overriding global profile and email fields without uniqueness checks), and delete those global accounts and their sessions. As a result, the attacker can take full control of user identities and disrupt legitimate service usage. The flaw is rooted in improper input validation and lack of uniqueness enforcement (CWE‑20).

The software impacted is the better‑auth SCIM plugin. Versions from 1.4.0‑beta.27 through 1.6.21, and from 1.7.0‑beta.0 through 1.7.0‑beta.9 contain the flaw. The fix is available in 1.6.22 and 1.7.0‑beta.10 (notably 1.7.0‑rc.0).

The CVSS score of 9.4 denotes a very high severity. The EPSS score is not available, suggesting limited data on real‑world exploitation likelihood, but the lack of KEV listing indicates that known exploits have not been reported yet. The attack vector is authenticated internal exploitation where an actor holds the rights to mint SCIM tokens. The logical provider ID collision permits the attacker to map a token to a different account, giving them broad read/write/delete privileges and enabling account takeover and deprovisioning. Given the high CVSS and the significant impact, the vulnerability presents an urgent risk to any deployed system that relies on this plugin.