CVE-2026-32725
High
Description
SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses ".." path components instead of rejecting them. As a result, an attacker can use parent-directory traversal in the scope claim to broaden the effective authorization beyond the intended directory. This issue has been patched in version 1.4.1.
SeverityHigh
CVSS8.3
Exploit probability—
ProductScitokens Cpp Library
PublishedMar 31, 2026
First seenMar 31, 2026
Weakness typeCWE-23CWE-23
How to fix
Update
- scitokens scitokens_cpp_library1.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| scitokens scitokens_cpp_library | v < 1.4.1 | 1.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.