CVE-2026-32726

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass in path-based scope validation. The enforcer used a simple string-prefix comparison when checking whether a requested resource path was covered by a token's authorized scope path. Because the check did not require a path-segment boundary, a token scoped to one path could incorrectly authorize access to sibling paths that merely started with the same prefix. This issue has been patched in version 1.4.1.

• CWE-863

• https://github.com/scitokens/scitokens-cpp/commit/decfe2f00cb9cabbf1e17a3bb2cd4ea1bbbd8a73Patch
• https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-q5fm-fgvx-32jqExploit, Vendor Advisory
• https://github.com/scitokens/scitokens-cpp/security/advisories/GHSA-q5fm-fgvx-32jqExploit, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32720The CTFer.io Monitoring component is in charge of the collec…7.1
• CVE-2026-32721LuCI is the OpenWrt Configuration Interface. Versions prior …4.8
• CVE-2026-32722Memray is a memory profiler for Python. Prior to Memray 1.19…6.1
• CVE-2026-32723SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…4.7
• CVE-2026-32724PX4 autopilot is a flight control solution for drones. Prior…5.3
• CVE-2026-32725SciTokens C++ is a minimal library for creating and using Sc…8.3
• CVE-2026-32727SciTokens is a reference library for generating and using Sc…6.5
• CVE-2026-32728Parse Server is an open source backend that can be deployed …7.6
• CVE-2026-32729Runtipi is a personal homeserver orchestrator. Prior to 4.8.…8.8
• CVE-2026-3273A vulnerability was identified in Tenda F453 1.0.0.3. Affect…8.8
• CVE-2026-32730ApostropheCMS is an open-source content management framework…8.1
• CVE-2026-32731ApostropheCMS is an open-source content management framework…9.9