CVE-2026-32725: SciTokens C++ Auth Bypass Vulnerability

CVE-2026-32725 Overview

CVE-2026-32725 is an authorization bypass vulnerability in SciTokens C++ (scitokens-cpp), a minimal library for creating and using SciTokens from C or C++. The vulnerability exists in how the library processes path-based scopes in tokens. Prior to version 1.4.1, the library normalizes the scope path from the token before authorization and collapses .. path components instead of rejecting them outright. This improper handling allows an attacker to leverage parent-directory traversal sequences within the scope claim to broaden their effective authorization beyond the intended directory boundaries.

Critical Impact

Attackers can exploit path traversal in scope claims to gain unauthorized access to resources outside their intended authorization scope, potentially compromising sensitive data and system integrity.

Affected Products

• SciTokens C++ (scitokens-cpp) versions prior to 1.4.1

Discovery Timeline

• 2026-03-31 - CVE-2026-32725 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-32725

Vulnerability Analysis

This vulnerability falls under CWE-23 (Relative Path Traversal) and represents an authorization bypass flaw in the token scope processing logic. The core issue stems from how scitokens-cpp handles path normalization during authorization checks. When a token containing a path-based scope is processed, the library performs normalization that includes collapsing relative path components like .. (parent directory references) rather than treating them as invalid input.

This design flaw creates a situation where an authenticated user can craft scope claims containing directory traversal sequences. When the library processes these malicious scope paths, the normalization routine collapses the .. components, effectively allowing the scope to reference directories above the originally intended authorization boundary. The network-accessible nature of this vulnerability means that any authenticated attacker with the ability to create or modify tokens can exploit this weakness remotely.

Root Cause

The root cause lies in the path normalization function within scitokens-cpp that processes scope claims. Instead of implementing strict input validation that rejects path components attempting directory traversal (such as ..), the library chose to normalize these paths by collapsing the traversal sequences. This approach prioritizes compatibility over security, creating an authorization bypass vector.

The correct security behavior should reject any scope path containing .. components outright, as these sequences have no legitimate use in authorization scope definitions and represent a clear attempt to escape the intended directory boundary.

Attack Vector

The attack leverages the network-accessible token processing functionality. An authenticated attacker can construct a malicious token with a scope claim containing path traversal sequences. For example, if a user is intended to have access only to /data/user123/, they could craft a scope path like /data/user123/../../admin/ which, after normalization, would grant access to /admin/.

The vulnerability requires low privileges (valid authentication) and no user interaction, making it relatively easy to exploit. The attacker simply needs to submit a crafted token to any service using the vulnerable scitokens-cpp library for scope-based authorization decisions.

For technical implementation details and the specific fix, refer to the GitHub Security Advisory GHSA-rqcx-mc9w-pjxp and the patch commit.

Detection Methods for CVE-2026-32725

Indicators of Compromise

• Token scope claims containing .. path traversal sequences
• Authorization logs showing access to directories outside expected user boundaries
• Unusual access patterns where users access resources in parent directories of their assigned scope
• Token validation events with normalized paths that differ significantly from the original scope claim

Detection Strategies

• Implement logging at the token validation layer to capture original scope claims before normalization
• Monitor authorization decisions for path-based scopes that resolve to sensitive directories
• Deploy runtime application security testing (RAST) to detect directory traversal patterns in token claims
• Create alerts for scope paths containing .. sequences in incoming tokens

Monitoring Recommendations

• Audit all systems using scitokens-cpp to identify vulnerable versions prior to 1.4.1
• Enable verbose logging for token processing to capture scope claim details
• Implement anomaly detection for users accessing resources outside their typical directory scope
• Review historical logs for evidence of exploitation attempts using path traversal patterns

How to Mitigate CVE-2026-32725

Immediate Actions Required

• Upgrade scitokens-cpp to version 1.4.1 or later immediately
• Audit token-based authorization logs for suspicious path traversal patterns
• Review any custom integrations with scitokens-cpp for additional validation requirements
• Implement input validation at the application layer as defense-in-depth while patching

Patch Information

The vulnerability has been patched in scitokens-cpp version 1.4.1. The fix modifies the path normalization behavior to properly reject scope paths containing .. traversal components rather than collapsing them. Organizations should update to the patched version as soon as possible.

The patch commit is available at the SciTokens GitHub repository.

Workarounds

• Implement application-level validation to reject tokens with scope paths containing .. sequences before they reach the scitokens-cpp library
• Deploy a reverse proxy or API gateway with path traversal detection to filter malicious tokens
• Restrict token issuance to trusted identity providers that enforce scope path validation
• Apply network segmentation to limit the blast radius of potential authorization bypass

# Verify scitokens-cpp version and update
# Check current version
pkg-config --modversion scitokens

# Update to patched version 1.4.1 or later
# Using package manager (if available)
apt-get update && apt-get install scitokens-cpp

# Or build from source with patched version
git clone https://github.com/scitokens/scitokens-cpp.git
cd scitokens-cpp
git checkout v1.4.1
mkdir build && cd build
cmake ..
make && make install