CVE-2026-32725

A flaw was found in SciTokens C++. An attacker can exploit this vulnerability by crafting malicious path-based scopes in tokens. The library incorrectly normalizes these scope paths, collapsing ".." path components instead of rejecting them. This allows an attacker to use parent-directory travers...

CVE-2026-32725

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses "....