CVE-2026-32716 | BDVDB-2026-323892 Detail

Description#

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-03-31Record published in the CVE List.