Scitokens — CraftedSignal Threat Feed

SciTokens Authorization Bypass Vulnerability (CVE-2026-32716)

hello@craftedsignal.io — Tue, 31 Mar 2026 03:17:16 +0000

SciTokens is a reference library for generating and using SciTokens. Versions prior to 1.9.6 are vulnerable to an authorization bypass. The vulnerability, identified as CVE-2026-32716, stems from incorrect validation of scope paths within the Enforcer component. Instead of performing an exact match, the Enforcer uses a simple prefix match (startswith). This flaw allows a token authorized for a specific path (e.g., /john) to also gain unauthorized access to sibling paths sharing the same…

SciTokens Library Path Traversal Vulnerability (CVE-2026-32727)

hello@craftedsignal.io — Tue, 31 Mar 2026 03:15:57 +0000

The SciTokens library, a reference implementation for generating and using SciTokens, is susceptible to a path traversal vulnerability affecting versions prior to 1.9.7. This vulnerability, identified as CVE-2026-32727, stems from the library’s Enforcer component. An attacker can exploit this flaw by crafting a malicious token containing a scope claim with “dot-dot” (..) sequences. These sequences allow the attacker to navigate outside the intended directory restriction, potentially accessing…

SciTokens KeyCache SQL Injection Vulnerability (CVE-2026-32714)

hello@craftedsignal.io — Tue, 31 Mar 2026 03:15:55 +0000

SciTokens is a reference library for generating and using SciTokens. A critical SQL injection vulnerability, identified as CVE-2026-32714, affects SciTokens versions prior to 1.9.6. The vulnerability resides within the KeyCache class, which improperly utilizes Python’s str.format() to construct SQL queries. This allows an attacker to inject arbitrary SQL commands by manipulating user-supplied data, such as the issuer and key_id parameters, during interactions with the local SQLite…