Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-32714SciTokens vulnerable to SQL Injection in KeyCache

Critical 9.8

In plain English

A critical-severity SQL injection in scitokens from scitokens. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 56.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (such as issuer and key_id). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. This issue has been patched in version 1.9.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	scitokens	1.9.6	GHSA-rh5m-2482-966c
PyPI	scitokens	1.9.6	PYSEC-2026-530

Affected products (as reported)

Vendor	Product	Versions
scitokens	scitokens	< 1.9.6

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/scitokens/scitokens/security/advisories/GHSA-rh5m-2482-966c x_refsource_CONFIRM
https://github.com/scitokens/scitokens/commit/3dba108853f2f4a6c0f2325c03779bf083c41cf2 x_refsource_MISC
https://github.com/scitokens/scitokens/releases/tag/v1.9.6 x_refsource_MISC