CVE-2026-32726

CVE-2026-32726 details an authorization bypass vulnerability in the SciTokens C++ library, affecting versions prior to 1.4.1. The flaw stems from a simple string-prefix comparison in path-based scope validation, allowing a token scoped to one path to incorrectly authorize access to sibling paths. Rated with a CVSS score of 8.1 (High), this vulnerability has a network attack vector and low attack complexity, potentially leading to high impact on confidentiality and integrity. There is currently no evidence of active exploitation, nor is public exploit code available, though the vulnerability has garnered some community discussion.