CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2026-32716
Medium (6.5) in scitokens scitokens library. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in scitokens 1.9.6.
SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
- CWE
- CWE-285
- Published
- Modified
- Record from
- the NVD, synced
Affected
- scitokens:scitokens_library
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w8fp-g9rh-34jh | PyPI | scitokens | <1.9.6 | 1.9.6 |
| PYSEC-2026-2276 | PyPI | scitokens | <1.9.6 | 1.9.6 |