The flaw causes non‑organization SCIM providers to be unbound from the creator by default, letting any authenticated user create and manage another user's provider. As a result, an attacker can regenerate bearer tokens, invalidate legitimate ones, and use the attacker controlled token to access SCIM API endpoints. This constitutes a significant authorization bypass that enables privileged activity such as creating, deleting, or modifying provider bindings and accessing data intended only for the original owner.

This issue affects the better‑auth SCIM component in versions from 1.5.0 up to but not including 1.7.0‑beta.4.

With a CVSS score of 8.7, the vulnerability is considered high impact. Exploitation requires only that the attacker holds valid credentials and can log in; no further privileges are needed. The EPSS score is unspecified, and the vulnerability is not currently listed in the CISA KEV catalog, but given its high severity and the ease of exploitation, the risk is significant for any environment running the affected versions.