High

SciTokens: Authorization Bypass via Path Traversal in Scope Validation

Type: advisorySources: OSV

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path (from the token) and the requested path (from the application) before comparing them using startswith. This issue has been patched in version 1.9.7.

Products: Not specified
Affected versions: Not specified
Fixed versions: Not specified
CVEs: CVE-2026-32727
Confirmed fixed CVEs: Not specified
Updated in this feed: 3 Nov 2026, 00:54 UTC · Revision 1

Source evidence

SciTokens: Authorization Bypass via Path Traversal in Scope Validation

core-osv · Original source

Published 31 Mar 2026, 01:31 UTC

osv:CVE-2026-32727

Complete source record

{
  "id": "9c6b37b379e7c78a77107317cd56b5ed7a94779d9254dc854ad115d90be11bb6",
  "url": "https://osv.dev/vulnerability/CVE-2026-32727",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SciTokens: Authorization Bypass via Path Traversal in Scope Validation",
    "summary": "SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended directory restriction. This occurs because the library normalizes both the authorized path (from the token) and the requested path (from the application) before comparing them using startswith. This issue has been patched in version 1.9.7.",
    "evidence": "osv:CVE-2026-32727",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-32727",
      "aliases": [
        "CVE-2026-32727",
        "GHSA-3x2w-63fp-3qvw",
        "PYSEC-2026-2277"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/scitokens/scitokens",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "49eab6db9c5c8ceb744e4b4770729e3e8ee7d039"
                },
                {
                  "fixed": "2d1cc9e42bc944fe0bbc429b85d166e7156d53f9"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:scitokens:scitokens_library:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.9.7"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "2d1cc9e42bc944fe0bbc429b85d166e7156d53f9"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "49eab6db9c5c8ceb744e4b4770729e3e8ee7d039"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.9.7"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.9.6",
            "v1.9.5",
            "v1.9.4",
            "v1.9.3",
            "v1.9.2",
            "v1.9.1",
            "v1.9.0",
            "v1.8.1",
            "v1.8.0",
            "v1.7.4",
            "v1.7.3",
            "v1.7.2",
            "v1.7.1",
            "v1.7.0",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0",
            "v1.5.0",
            "v1.4.0",
            "v1.3.1",
            "v1.3.0",
            "v1.2.4",
            "v1.2.3",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.1",
            "v1.1.0",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0",
            "v0.3.3",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.5",
            "v0.1.4",
            "v0.1.3",
            "v0.1.2",
            "v0.1.1",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32727.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:24.783600413Z",
      "provider": "osv",
      "references": [
        "https://github.com/scitokens/scitokens/releases/tag/v1.9.7",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32727.json",
        "https://github.com/scitokens/scitokens/security/advisories/GHSA-3x2w-63fp-3qvw",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-32727",
        "https://github.com/scitokens/scitokens/commit/2d1cc9e42bc944fe0bbc429b85d166e7156d53f9",
        "https://github.com/scitokens/scitokens/pull/230"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32727.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-32727",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 491344,
  "published_at": "2026-03-31T01:31:57.392+00:00"
}