Executive brief
SciTokens C++ is a library used to manage security tokens for accessing scientific data and resources. A flaw in how the library validates access permissions allows a user with limited access to one folder to potentially access other folders that start with the same name (for example, access to '/data' might incorrectly grant access to '/data-private'). This could lead to unauthorized data exposure or modification in shared storage environments.
Technical details
The vulnerability exists in the Enforcer::scope_validator function within src/scitokens_internal.cpp. The library performed a simple string-prefix comparison to validate if a requested resource path was covered by a token's authorized scope, failing to check for path-segment boundaries (e.g., a trailing slash). Consequently, a token scoped for '/john' would incorrectly authorize access to '/johnathan' or '/johnny'. An attacker with a valid token for a specific path can exploit this over network-reachable services to access or modify data in sibling namespaces. The issue is resolved in version 1.4.1 by implementing segment-aware path matching.
Affected products
- SciTokens scitokens-cpp < 1.4.1
Timeline
- 2026-03-30: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE-2026-32726 published to NVD
- 2026-03-31: patched: Version 1.4.1 released