CVE-2026-32726

SciTokens C++ prior to 1.4.1 contains an authorization bypass in path-based scope validation. The enforcer used a string-prefix check without requiring a path boundary, allowing a token scoped to one path to authorize sibling paths sharing a prefix. This vulnerability has a CVSS v3.1 base score o...