PT-2026-29184 · Scitokens · Scitokens

Pmcao · Published 2026-03-31 · Updated 2026-04-04 · CVE-2026-32716

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SciTokens versions prior to 1.9.6

Description SciTokens is a library for generating and using SciTokens. The Enforcer component incorrectly validates scope paths using a simple prefix match, allowing a token with access to a specific path to also access sibling paths that share the same prefix. This results in an Authorization Bypass. The issue occurs because the startswith method is used for scope path validation, which is insufficient for secure access control. The vulnerable component is the Enforcer.

Recommendations Update to SciTokens version 1.9.6 or later.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-32716

GHSA-W8FP-G9RH-34JH

OPENSUSE-SU-2026:10491-1

Affected Products

Scitokens

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32716.json · Exploit
• https://github.com/scitokens/scitokens/commit/7a237c0f642efb9e8c36ac564b745895cca83583 · Patch
• https://github.com/scitokens/scitokens/security/advisories/GHSA-w8fp-g9rh-34jh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32716 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w8fp-g9rh-34jh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32716 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10491-1 · Vendor Advisory
• https://github.com/scitokens/scitokens/releases/tag/v1.9.6 · Note
• https://github.com/scitokens/scitokens · Note
• https://suse.com/security/cve/CVE-2026-32714 · Note
• https://twitter.com/TheHackerWire/status/2038828610921115794 · Twitter Post
• https://twitter.com/CVEnew/status/2038916046946812290 · Twitter Post
• https://suse.com/security/cve/CVE-2026-32716 · Note
• https://twitter.com/CVEarity/status/2038931465732522041 · Twitter Post
• https://suse.com/security/cve/CVE-2026-32727 · Note