SciTokens is a reference library for generating and using SciTokens.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 31, 2026 · NIST NVD

   Detected

   SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patche

2. Jun 17, 2026 · NIST NVD

   Updated

   SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patche

Affected

• cpe scitokens/scitokens libraryversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-32716

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-32716

  SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths t

  nvd.nist.gov

References

• Patch · github.com
• Release Notes · github.com
• Exploit · github.com