CVE-2026-32725

CVE-2026-32725 is a high-severity authorization bypass vulnerability (CWE-23) affecting the SciTokens C++ library prior to version 1.4.1. This flaw allows an attacker to use parent-directory traversal in token scope claims to broaden effective authorization beyond intended directories, due to improper path normalization. With a CVSS v3.1 score of 8.3 (High), it can be exploited remotely with low attack complexity, potentially leading to high confidentiality and integrity impacts. There is currently no evidence of active exploitation, nor is public exploit code available. However, the vulnerability has garnered some community discussion since its disclosure.