PT-2026-29185 · Scitokens · Scitokens

Pmcao · Published 2026-03-31 · Updated 2026-04-04 · CVE-2026-32727

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SciTokens versions prior to 1.9.7

Description SciTokens is a library for generating and using SciTokens. The Enforcer component is susceptible to a path traversal issue. An attacker can exploit this by including 'dot-dot' (..) sequences within the scope claim of a token, allowing them to bypass intended directory restrictions. The library normalizes both the authorized path from the token and the requested path from the application before comparing them using the startswith() function, which enables the path traversal.

Recommendations Update to version 1.9.7 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-32727

GHSA-3X2W-63FP-3QVW

OPENSUSE-SU-2026:10491-1

Affected Products

Scitokens

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32727.json · Exploit
• https://github.com/scitokens/scitokens/security/advisories/GHSA-3x2w-63fp-3qvw · Vendor Advisory
• https://github.com/scitokens/scitokens/commit/2d1cc9e42bc944fe0bbc429b85d166e7156d53f9 · Patch
• https://osv.dev/vulnerability/GHSA-3x2w-63fp-3qvw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32727 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32727 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10491-1 · Vendor Advisory
• https://github.com/scitokens/scitokens/releases/tag/v1.9.7 · Note
• https://github.com/scitokens/scitokens · Note
• https://github.com/scitokens/scitokens/pull/230 · Note
• https://suse.com/security/cve/CVE-2026-32727 · Note
• https://suse.com/security/cve/CVE-2026-32716 · Note
• https://twitter.com/TheHackerWire/status/2038828864726839556 · Twitter Post
• https://twitter.com/CVEnew/status/2038916045952676140 · Twitter Post
• https://suse.com/security/cve/CVE-2026-32714 · Note