CVE-2026-32726 Details
Description
SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass in path-based scope validation. The enforcer used a simple string-prefix comparison when checking whether a requested resource path was covered by a token's authorized scope path. Because the check did not require a path-segment boundary, a token scoped to one path could incorrectly authorize access to sibling paths that merely started with the same prefix. This issue has been patched in version 1.4.1.
A high-severity authorization bypass vulnerability has been identified in SciTokens C++ versions prior to 1.4.1. The issue arises in the Enforcer's scope validation, where a simple string-prefix comparison is used to determine if a requested resource path is covered by a token's authorized scope. This approach fails to enforce path-segment boundaries, allowing tokens scoped to one path to incorrectly authorize access to sibling paths that share the same prefix. For example, a token scoped to '/john' could mistakenly grant access to '/johnathan' or '/johnny', which are sibling paths, not descendants. This vulnerability has been addressed in version 1.4.1.
Users can upgrade to SciTokens C++ version 1.4.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-q5fm-fgvx-32jq | CISA-ADP | ExploitVendor Advisory |
| https://github.com/scitokens/scitokens-cpp/commit/decfe2f00cb9cabbf1e17a3bb2cd4ea1bbbd8a73 | [email protected] | Patch |
| https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-q5fm-fgvx-32jq | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| scitokens scitokens cpp library | < 1.4.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | New CVE Received | [email protected] |