CVE-2026-32716 in SciTokens

요약 (영어)

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.

책임이 있는

GitHub_M

예약하다

2026. 03. 13.

공개

2026. 03. 31.

엔트리

VulDB provides additional information and datapoints for this CVE:

아이디	취약성	CWE	악용	대책	CVE
354308	SciTokens 권한 상승	285	정의되지 않음	공식 수정	CVE-2026-32716