CVE-2026-32714 SciTokens vulnerable to SQL Injection in KeyCache

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format to construct SQL queries with user-supplied data such as issuer and keyid. This allowed an attacker to...

CVE-2026-32714

creationtimestamp| type| source ---|---|--- 2026-03-30 20:27:55+00:00| published-proof-of-concept| https://github.com/scitokens/scitokens/security/advisories/GHSA-rh5m-2482-966c 2026-03-31 04:06:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3midcfsxmyc2s 2026-03-31...