PT-2026-29312 · Scitokens · Scitokens

Pmcao · Published 2026-03-31 · Updated 2026-04-02 · CVE-2026-32725

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions SciTokens C++ versions prior to 1.4.1

Description SciTokens C++ is a library for creating and using SciTokens. Versions before 1.4.1 have an authorization bypass when handling path-based scopes within tokens. The library normalizes the scope path, collapsing ".." path components instead of rejecting them. This allows an attacker to use parent directory traversal in the scope claim to expand authorization beyond the intended directory. The vulnerability occurs during the processing of the scope claim within SciTokens.

Recommendations Update to SciTokens C++ version 1.4.1 or later.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-32725

GHSA-RQCX-MC9W-PJXP

Affected Products

Scitokens

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32725.json · Exploit
• https://github.com/scitokens/scitokens-cpp/commit/7951ed809967d88c00c20de414b1ff74df8c3e08 · Patch
• https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-rqcx-mc9w-pjxp · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32725 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32725 · Security Note
• https://ubuntu.com/security/CVE-2026-32725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32725 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32725 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32725 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32725 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2039047584933920944 · Twitter Post