CVE-2026-32726 SciTokens C++: Sibling-Path Authorization Bypass
Attackers can bypass path-based authorization checks in SciTokens C++ by exploiting prefix matching flaws, gaining unauthorized access to sibling resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32726?
CVE-2026-32726 is a high-severity authentication bypass vulnerability in scitokens-cpp, published on 31 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass in path-based scope validation. The enforcer used a simple string-prefix comparison when checking whether a requested resource path was covered by a token's authorized scope path. Because the check did not require a path-segment boundary, a token scoped to one path could incorrectly authorize access to sibling paths that merely started with the same prefix. This issue has been patched in version 1.4.1.
Weakness: CWE-863
Which versions are affected by CVE-2026-32726?
It affects 1 product.
Products include Scitokens Scitokens Cpp Library.
How do I fix CVE-2026-32726?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-32726 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32726 exists.
Other vulnerabilities in scitokens-cpp
Sources
Also known as DEBIAN-CVE-2026-32726, GHSA-q5fm-fgvx-32jq, UBUNTU-CVE-2026-32726.