CVE-2026-32725

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses ".." path components instead of rejecting them. As a result, an attacker can use parent-directory traversal in the scope claim to broaden the effective authorization beyond the intended directory. This issue has been patched in version 1.4.1.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/scitokens/scitokens-cpp/commit/7951ed809967d88c00c20de414b1ff74df8c3e08	Patch
https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-rqcx-mc9w-pjxp	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:scitokens:scitokens_cpp_library:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-31 18:16

Updated : 2026-07-24 20:10

NVD link : CVE-2026-32725

Mitre link : CVE-2026-32725

CVE.ORG link : CVE-2026-32725

JSON object : View

Products Affected

scitokens

scitokens_cpp_library

CWE

CWE-23

Relative Path Traversal

{"id": "CVE-2026-32725", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32725", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-03T16:14:03.357530Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "scitokens", "product": "scitokens-cpp", "versions": [{"status": "affected", "version": "< 1.4.1"}]}]}], "published": "2026-03-31T18:16:50.837", "references": [{"url": "https://github.com/scitokens/scitokens-cpp/commit/7951ed809967d88c00c20de414b1ff74df8c3e08", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-rqcx-mc9w-pjxp", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses \"..\" path components instead of rejecting them. As a result, an attacker can use parent-directory traversal in the scope claim to broaden the effective authorization beyond the intended directory. This issue has been patched in version 1.4.1."}, {"lang": "es", "value": "SciTokens C++ es una biblioteca m\u00ednima para crear y usar SciTokens desde C o C++. Antes de la versi\u00f3n 1.4.1, scitokens-cpp es vulnerable a una omisi\u00f3n de autorizaci\u00f3n al procesar \u00e1mbitos basados en rutas en tokens. La biblioteca normaliza la ruta del \u00e1mbito del token antes de la autorizaci\u00f3n y colapsa los componentes de ruta '..' en lugar de rechazarlos. Como resultado, un atacante puede usar el salto de directorio padre en la declaraci\u00f3n de \u00e1mbito para ampliar la autorizaci\u00f3n efectiva m\u00e1s all\u00e1 del directorio previsto. Este problema ha sido parcheado en la versi\u00f3n 1.4.1."}], "lastModified": "2026-07-24T20:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:scitokens:scitokens_cpp_library:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC9F84FE-5692-462D-BA2B-D9703D8AFAD1", "versionEndExcluding": "1.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}