CVE-2026-32726 is an authorization bypass vulnerability in SciTokens C++. The vulnerability exists due to a simple string-prefix comparison in path-based scope validation, which could allow an attacker to access sibling paths. The issue has been patched in version 1.4.1. Affected users should update to the patched version and review affected systems and applications. The vulnerability has a high CVSS score of 8.1.
CVE-2026-32725 is an authorization bypass vulnerability in the SciTokens C++ library prior to version 1.4.1. The library is used for creating and using SciTokens from C or C++. The vulnerability occurs when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses '..' path components instead of rejecting them. This allows an attacker t [truncated]
