CVE-2026-32725 - Vulnerability Analysis

Overview

SciTokens C++ < 1.4.1 contains an authorization bypass caused by improper normalization of path-based scopes allowing parent-directory traversal in scope claims, letting attackers broaden authorization beyond intended directories, exploit requires crafted token scope.

Severity & Score

Impact

Attackers can bypass authorization to access resources beyond intended directories, potentially exposing sensitive data.

Mitigation

Update to version 1.4.1 or later.

References

• https://github.com/scitokens/scitokens-cpp/commit/7951ed809967d88c00c20de414b1ff74df8c3e08
• https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-rqcx-mc9w-pjxp

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner