Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-32727SciTokens: Authorization Bypass via Path Traversal in Scope Validation

High 8.1

In plain English

A high-severity path traversal in scitokens from scitokens. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 55.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path (from the token) and the requested path (from the application) before comparing them using startswith. This issue has been patched in version 1.9.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	scitokens	1.9.7	GHSA-3x2w-63fp-3qvw
PyPI	scitokens	1.9.7	PYSEC-2026-2277

Affected products (as reported)

Vendor	Product	Versions
scitokens	scitokens	< 1.9.7

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/scitokens/scitokens/security/advisories/GHSA-3x2w-63fp-3qvw x_refsource_CONFIRM
https://github.com/scitokens/scitokens/pull/230 x_refsource_MISC
https://github.com/scitokens/scitokens/commit/2d1cc9e42bc944fe0bbc429b85d166e7156d53f9 x_refsource_MISC
https://github.com/scitokens/scitokens/releases/tag/v1.9.7 x_refsource_MISC