CVE-2026-32716
High · 8.1CVSS
8.1
EPSS
0.4%
Published
Mar 31, 2026
CISA due date
—
The record
SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-scitokens | 0 | 1.8.1-2.1 |
Related vulnerabilities
- CVE-2026-32727 SciTokens is a reference library for generating and using SciTokens. Also affects python-scitokens
- CVE-2026-32714 SciTokens is a reference library for generating and using SciTokens. Also affects python-scitokens
- CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on certain… CWE-285
- CVE-2026-21097 Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1… CWE-285
- CVE-2026-86804 A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. CWE-285
- CVE-2026-86277 A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management &… CWE-285
- CVE-2026-86283 MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp)… CWE-285
- CVE-2026-86212 A vulnerability has been found in Open5GS 2.7.7/2.8.0. CWE-285