PT-2026-29185 · Scitokens · Scitokens

Pmcao · Publicado 2026-03-31 · Atualizado 2026-04-04 · CVE-2026-32727

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SciTokens versions prior to 1.9.7

Description SciTokens is a library for generating and using SciTokens. The Enforcer component is susceptible to a path traversal issue. An attacker can exploit this by including 'dot-dot' (..) sequences within the scope claim of a token, allowing them to bypass intended directory restrictions. The library normalizes both the authorized path from the token and the requested path from the application before comparing them using the startswith() function, which enables the path traversal.

Recommendations Update to version 1.9.7 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-32727

GHSA-3X2W-63FP-3QVW

OPENSUSE-SU-2026:10491-1

Produtos afetados

Scitokens

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32727.json · Exploit
• https://github.com/scitokens/scitokens/releases/tag/v1.9.7 · Nota
• https://github.com/scitokens/scitokens · Nota
• https://github.com/scitokens/scitokens/security/advisories/GHSA-3x2w-63fp-3qvw · Aviso do Fabricante
• https://github.com/scitokens/scitokens/commit/2d1cc9e42bc944fe0bbc429b85d166e7156d53f9 · Correção
• https://github.com/scitokens/scitokens/pull/230 · Nota
• https://osv.dev/vulnerability/GHSA-3x2w-63fp-3qvw · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-32727 · Nota
• https://suse.com/security/cve/CVE-2026-32716 · Nota
• https://twitter.com/TheHackerWire/status/2038828864726839556 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2038916045952676140 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-32714 · Nota
• https://twitter.com/CVEarity/status/2038934251148890377 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32727 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32727 · Aviso do Fabricante