CVE-2026-32716

Katalog CVE

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Improper Authorization pada scitokens library. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/scitokens/scitokens/security/advisories/GHSA-w8fp-g9rh-34jh exploit · advisory vendor
• https://github.com/scitokens/scitokens/commit/7a237c0f642efb9e8c36ac564b745895cca83583 patch
• https://github.com/scitokens/scitokens/releases/tag/v1.9.6 release notes