CVE-2026-32714 is a critical SQL Injection vulnerability found in the KeyCache class of the SciTokens library, affecting versions prior to 1.9.6. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands against the local SQLite database by manipulating user-supplied data during query construction. Rated 9.8 CRITICAL (CVSSv3.1), it has a network attack vector with low complexity, requiring no privileges or user interaction, and can lead to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation and no public exploit code available, the vulnerability has garnered some community discussion. Organizations using affected SciTokens versions should upgrade to 1.9.6 immediately to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.9.6CPE matchmatch criteria | cpe:2.3:a:scitokens:scitokens_library:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.