PT-2026-29183 · Scitokens · Scitokens

Pmcao · Published 2026-03-31 · Updated 2026-04-04 · CVE-2026-32714

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SciTokens versions prior to 1.9.6

Description SciTokens is a reference library for generating and using SciTokens. The KeyCache class was susceptible to SQL Injection due to the use of Python’s str.format() function to construct SQL queries with user-supplied data, such as the issuer and key id. This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. The issue was addressed in version 1.9.6.

Recommendations Update to SciTokens version 1.9.6 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-32714

GHSA-RH5M-2482-966C

OPENSUSE-SU-2026:10491-1

Affected Products

Scitokens

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32714.json · Exploit
• 🔥 https://github.com/scitokens/scitokens/security/advisories/GHSA-rh5m-2482-966c · Exploit
• https://github.com/scitokens/scitokens/commit/3dba108853f2f4a6c0f2325c03779bf083c41cf2 · Patch
• https://osv.dev/vulnerability/CVE-2026-32714 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10491-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rh5m-2482-966c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32714 · Security Note
• https://github.com/scitokens/scitokens/releases/tag/v1.9.6 · Note
• https://github.com/scitokens/scitokens · Note
• https://suse.com/security/cve/CVE-2026-32727 · Note
• https://twitter.com/CosmicBytez/status/2039182108468678722 · Twitter Post
• https://suse.com/security/cve/CVE-2026-32714 · Note
• https://suse.com/security/cve/CVE-2026-32716 · Note
• https://twitter.com/pulsepatchio/status/2039361441459765654 · Twitter Post
• https://twitter.com/0dayPublishing/status/2038804566611796055 · Twitter Post