PT-2026-29183 · Scitokens · Scitokens

Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-32714

Mitre

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (such as issuer and key id). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. This issue has been patched in version 1.9.6.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-32714

Affected Products

Scitokens

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32714 · Security Note
• https://github.com/scitokens/scitokens/commit/3dba108853f2f4a6c0f2325c03779bf083c41cf2 · Note
• https://github.com/scitokens/scitokens/security/advisories/GHSA-rh5m-2482-966c · Note
• https://github.com/scitokens/scitokens/releases/tag/v1.9.6 · Note