SCIM Exploitation: Hacking the Provisioning Layer

SCIM recon via ServiceProviderConfig, externalId collision for admin takeover, email hijacking via PATCH, unauthenticated endpoints, and group membership escalation