Executive brief
SciTokens C++ is a library used to manage security tokens for scientific computing environments. A flaw in how the library handles file paths within these tokens allows a user with a valid token to access files or directories they shouldn't be able to see. By including special characters in the token, an attacker can 'climb' out of their assigned folder and access sensitive data belonging to other users or the system itself.
Technical details
The vulnerability exists in the Enforcer::scope_validator and normalize_absolute_path functions within src/scitokens_internal.cpp. When processing path-based scopes (e.g., 'read:/home/user1/..'), the library collapses '..' components during normalization instead of rejecting them. This allows an attacker with a low-privileged token to escalate their authorization to parent or sibling directories (e.g., normalizing to '/home' or '/'). The issue is reachable via the network if the application using the library accepts tokens from remote users. A fix is available in version 1.4.1 which implements strict scope-path validation and rejects traversal components.
Affected products
- scitokens scitokens-cpp < 1.4.1
Timeline
- 2026-03-13: patched: Fix implemented in development branch.
- 2026-03-30: advisory: GitHub Security Advisory published.
- 2026-03-31: disclosed: CVE-2026-32725 published.