SCIM
An open standard protocol (based on RFC 7644) for automating cross-domain user identity management. It uses standardized REST APIs to synchronize user creation, updates, and deletion between identity providers and service providers, serving as the de facto standard for enterprise SaaS identity governance.
Core Facts
SCIM is the System for Cross-domain Identity Management, which plays a core role in automated user provisioning.
WorkOS is a technology company focused on providing enterprise-grade identity authentication and user management infrastructure for SaaS applications, with products covering core enterprise IT capabilities such as SSO (Single Sign-On), SCIM directory synchronization, and audit logs.
Timeline (last 90 days)
Perforce disclosed the CVE-2026-109758 vulnerability, which involves issues with default tokens and a PATCH path parser in its SCIM implementation.
The security of a SCIM endpoint does not depend on the protocol itself, but on implementation details.
Besides the default token and path parser issues, other common problems with SCIM endpoints include denial of service caused by pagination parameters, filter expression injection, and privilege bypass caused by group nesting.
Many SCIM implementations have built-in static sample tokens or default tokens that can be found in documentation and allow them to be used long-term without being changed; if administrators do not proactively replace them, such tokens effectively become public credentials.
A secure implementation should first parse SCIM paths into an abstract syntax tree, then map them to fixed parameterized operations based on a whitelist, preventing path content from entering the execution context in any form.
If a SCIM path parser uses regular expressions or string concatenation to map paths to database queries, LDAP filters or shell commands, attackers can inject special characters to break out of the intended scope, modify attributes that should not be touched, and even trigger command execution.
SCIM PATCH defines a set of partial update semantics based on path expressions, including three types of operations: add, remove and replace, with path syntax drawing on XPath-like filters.
The SCIM standard itself does not specify a particular authentication mechanism, and only recommends the use of OAuth 2.0.
The SCIM protocol supports creating, updating and deleting users and groups, so SCIM endpoints inherently carry administrator-level operation privileges.
SCIM is an open standard published by the IETF, initially jointly promoted by vendors such as Salesforce, Google and Microsoft; it is REST-style, uses JSON as its data format, and defines core resource models such as User, Group and EnterpriseUser.
40 more timeline events
All Facts (20)
SCIM is the System for Cross-domain Identity Management, which plays a core role in automated user provisioning.
75%VerifiedWorkOS is a technology company focused on providing enterprise-grade identity authentication and user management infrastructure for SaaS applications, with products covering core enterprise IT capabilities such as SSO (Single Sign-On), SCIM directory synchronization, and audit logs.
65%UnverifiedSCIM (System for Cross-domain Identity Management) is currently at version 2.0 and is an IETF-standardized user directory synchronization protocol
60%UnverifiedMany SCIM implementations have built-in static sample tokens or default tokens that can be found in documentation and allow them to be used long-term without being changed; if administrators do not proactively replace them, such tokens effectively become public credentials.
50%UnverifiedSCIM is an open standard published by the IETF, initially jointly promoted by vendors such as Salesforce, Google and Microsoft; it is REST-style, uses JSON as its data format, and defines core resource models such as User, Group and EnterpriseUser.
50%UnverifiedA secure implementation should first parse SCIM paths into an abstract syntax tree, then map them to fixed parameterized operations based on a whitelist, preventing path content from entering the execution context in any form.
50%UnverifiedBesides the default token and path parser issues, other common problems with SCIM endpoints include denial of service caused by pagination parameters, filter expression injection, and privilege bypass caused by group nesting.
50%UnverifiedThe security of a SCIM endpoint does not depend on the protocol itself, but on implementation details.
50%UnverifiedSCIM PATCH defines a set of partial update semantics based on path expressions, including three types of operations: add, remove and replace, with path syntax drawing on XPath-like filters.
50%UnverifiedPerforce's SCIM implementation allows authentication using the default bearer token publicly documented in the documentation and does not mandate changing it, so an attacker only needs to know the token value to call the SCIM API with administrator privileges.
50%UnverifiedPerforce's SCIM PATCH path parser fails to properly filter input, allowing attackers to construct malicious paths that break out of the intended attribute modification scope, and in some tests even allowing arbitrary code execution.
50%UnverifiedThe SCIM standard itself does not specify a particular authentication mechanism, and only recommends the use of OAuth 2.0.
50%UnverifiedThe SCIM protocol supports creating, updating and deleting users and groups, so SCIM endpoints inherently carry administrator-level operation privileges.
50%UnverifiedIf a SCIM path parser uses regular expressions or string concatenation to map paths to database queries, LDAP filters or shell commands, attackers can inject special characters to break out of the intended scope, modify attributes that should not be touched, and even trigger command execution.
50%UnverifiedWhen comparing SSO and SCIM vendors, it is recommended to ask them to provide a complete pricing breakdown and to clarify the definition of the billing unit for a 'connection', whether SCIM is billed separately, the tiered pricing after exceeding the plan, technical support response time, and the contract term and renewal price adjustment mechanism.
50%UnverifiedSSO solves the authentication problem of 'log in once to access multiple applications', while SCIM solves the provisioning problem of 'when accounts are created, modified, and deleted'; the two are different protocols and are priced differently.
50%Unverified在SCIM场景下，leaver账号残留通常有两种成因：一是IdP侧配置未启用停用推送，目录根本不发送active:false；二是端点侧未正确处理IdP发来的PUT、PATCH或DELETE。
50%UnverifiedOkta在配置SCIM应用时默认倾向于使用PATCH操作来更新用户属性，其请求体通常包含指向urn:ietf:params:scim:api:messages:2.0:PatchOp的schemas数组和Operations列表。
50%UnverifiedEntra ID的SCIM供给服务更倾向于使用PUT操作来替换整个资源，而不是PATCH；其请求体包含完整的用户表示，如果端点在PUT处理中只更新部分字段可能意外覆盖已有数据。
50%Unverified当用户在Entra ID中被禁用或从供给范围中移除时，Entra ID可能发送active: false的PATCH，也可能直接停止发送请求，具体取决于配置是软删除还是硬删除；如果配置为硬删除，Entra ID可能发送DELETE请求。
50%