CVE-2026-32716 SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking
Attackers can bypass authorization checks to access sibling paths due to incorrect prefix matching in the SciTokens library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32716?
CVE-2026-32716 is a high-severity authentication bypass vulnerability in scitokens, published on 31 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.
Weakness: CWE-285
Which versions are affected by CVE-2026-32716?
3 open source packages ship an affected version, including scitokens. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
scitokens PyPI | All versions | 1.9.6 |
scitokens PyPI | All versions | 1.9.6 |
scitokens PyPI | All versions | 1.9.6 |
Products include Scitokens Scitokens Library.
How do I fix CVE-2026-32716?
Upgrade scitokens to 1.9.6 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-32716 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32716 exists.
Other vulnerabilities in scitokens
Sources
Also known as GHSA-w8fp-g9rh-34jh, PYSEC-2026-2276.