CVE-2026-32725 Scitokens CVE debrief

Who should care

Users of the SciTokens C++ library, especially those using versions prior to 1.4.1, should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 1.4.1 or later, and ensuring that the library is used in a secure manner. Operators, platform administrators, vulnerability management teams, and security teams should review the affected scope and vendor guidance.

Technical summary

The SciTokens C++ library is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses '..' path components instead of rejecting them. This allows an attacker to use parent-directory traversal in the scope claim to broaden the effective authorization beyond the intended directory. The vulnerability has been patched in version 1.4.1. The library is used for creating and using SciTokens from C or C++.

Defensive priority

High

Recommended defensive actions

• Update to version 1.4.1 or later
• Ensure secure usage of the library
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by an unknown source and patched in version 1.4.1. The NVD entry is currently Analyzed. Evidence is limited, and defenders should verify the affected scope and vendor guidance. The SciTokens C++ library is used for creating and using SciTokens from C or C++. The library normalizes the scope path from the token before authorization and collapses '..' path components instead of rejecting them, allowing an attacker to use parent-directory traversal in the scope claim to broaden the effective authorization beyond the intended directory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.