CVE-2026-32725Disclosure(scitokens / scitokens_cpp_library)

LOWCVSS 8.3 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses ".." path components instead of rejecting them. As a result, an attacker can use parent-directory traversal in the scope claim to broaden the effective authorization beyond the intended directory. This issue has been patched in version 1.4.1.

scitokens CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/scitokens/scitokens-cpp/commit/7951ed809967d88c00c20de414b1ff74df8c3e08

Exploit / PoC references

https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-rqcx-mc9w-pjxp

Weakness type (CWE)

CWE-23

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

scitokens_cpp_library

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Affected systems

Vendors

scitokens

Products

scitokens_cpp_library

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.thehackerwire.com/vulnerability/CVE-2026-32725/

Full discourse1 post

The Hacker Wire@TheHackerWire191d
Disclosure
🟠 CVE-2026-32725 - High SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based sc... https://www.thehackerwire.com/vulnerability/CVE-2026-32725/ https://t.co/yFKmZrkfcL
Post summary
CVE-2026-32725 is a high‑severity authorization bypass in SciTokens C++ before v1.4.1, with no PoC, exploit, or patch disclosed.
0000043
163 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	scitokens	scitokens_cpp_library	-	-	-

Explore more

Back to dashboard scitokens CVEs scitokens_cpp_library vulnerabilities