CVE-2026-32716

Description

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.

Weakness classification

• security-advisories@github.com: CWE-285

Primary references

• security-advisories@github.com — Patch
• security-advisories@github.com — Release Notes
• security-advisories@github.com — Exploit, Vendor Advisory