SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.

Affected: PyPI: scitokens

### Summary The `Enforcer` incorrectly validates scope paths by using a simple prefix match (`startswith`). This allows a token with access to a specific path (e.g., `/john`) to also access sibling paths that start with the same prefix (e.g., `/johnathan`, `/johnny`), which is an **Authorization Bypass**.

### Details **File:** `src/scitokens/scitokens.py` **Methods:** `_validate_scp` and `_validate_scope`

### Vulnerable Code Snippets:

**In `_validate_scp` (around line 696):** ```python for scope in value: authz, norm_path = self._check_scope(scope) if (self._test_authz == authz) and norm_requested_path.startswith(norm_path): return True ```

**In `_validate_scope` (around line 722):** ```python for scope in value.split(" "): authz, norm_path = self._check_scope(scope) if (self._test_authz == authz) and norm_requested_path.startswith(norm_path): return True ```

If `norm_path` (authorized) is `/john` and `norm_requested_path` (requested) is `/johnathan`, `startswith` returns `True`, incorrectly granting access.

### PoC ```

import scitokens import sys

def poc_scope_bypass(): """ Demonstrate an Authorization Bypass vulnerability in scope path checking. """ print("--- PoC: Incorrect Scope Path Checking (Authorization Bypass) ---") issuer = "https://scitokens.org/unittest" enforcer = scitokens.Enforcer(issuer) # Create a token with access to /john token = scitokens.Sc…

python311-scitokens-1.8.1-2.1 on GA media

Affected: PyPI: scitokens

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.