The application admin was grant with one role let say ADMIN
and that role had

GRANT ALTER USER TO ADMIN
/
GRANT CREATE ANY SYNONYM TO ADMIN
/
GRANT CREATE ANY TABLE TO ADMIN
/
GRANT CREATE USER TO ADMIN
/
GRANT DROP USER TO ADMIN
/

when I log in as a user with DBA privilege, I created the new users with no problems.