CVE-2026-32725

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses ".." path components instead of rejecting them. As a result, an attacker can use parent-directory traversal in the scope claim to broaden the effective authorization beyond the intended directory. This issue has been patched in version 1.4.1.

• CWE-23

• https://github.com/scitokens/scitokens-cpp/commit/7951ed809967d88c00c20de414b1ff74df8c3e08Patch
• https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-rqcx-mc9w-pjxpExploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3272A vulnerability was determined in Tenda F453 1.0.0.3. Affect…8.8
• CVE-2026-32720The CTFer.io Monitoring component is in charge of the collec…7.1
• CVE-2026-32721LuCI is the OpenWrt Configuration Interface. Versions prior …4.8
• CVE-2026-32722Memray is a memory profiler for Python. Prior to Memray 1.19…6.1
• CVE-2026-32723SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…4.7
• CVE-2026-32724PX4 autopilot is a flight control solution for drones. Prior…5.3
• CVE-2026-32726SciTokens C++ is a minimal library for creating and using Sc…8.1
• CVE-2026-32727SciTokens is a reference library for generating and using Sc…6.5
• CVE-2026-32728Parse Server is an open source backend that can be deployed …7.6
• CVE-2026-32729Runtipi is a personal homeserver orchestrator. Prior to 4.8.…8.8
• CVE-2026-3273A vulnerability was identified in Tenda F453 1.0.0.3. Affect…8.8
• CVE-2026-32730ApostropheCMS is an open-source content management framework…8.1