https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 19:46:43 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-278294 EUVD-2026-278294 https://cve.radiocsirt.org/vuln/euvd-2026-278294 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32716 <p>SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.</p> <p>SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32716 https://cve.radiocsirt.org/vuln/ghsa-w8fp-g9rh-34jh <p><strong>Affected:</strong> PyPI: scitokens</p> <p>### Summary The `Enforcer` incorrectly validates scope paths by using a simple prefix match (`startswith`). This allows a token with access to a specific path (e.g., `/john`) to also access sibling paths that start with the same prefix (e.g., `/johnathan`, `/johnny`), which is an **Authorization Bypass**.</p> <p>### Details **File:** `src/scitokens/scitokens.py` **Methods:** `_validate_scp` and `_validate_scope`</p> <p>### Vulnerable Code Snippets:</p> <p>**In `_validate_scp` (around line 696):** ```python for scope in value: authz, norm_path = self._check_scope(scope) if (self._test_authz == authz) and norm_requested_path.startswith(norm_path): return True ```</p> <p>**In `_validate_scope` (around line 722):** ```python for scope in value.split(&#34; &#34;): authz, norm_path = self._check_scope(scope) if (self._test_authz == authz) and norm_requested_path.startswith(norm_path): return True ```</p> <p>If `norm_path` (authorized) is `/john` and `norm_requested_path` (requested) is `/johnathan`, `startswith` returns `True`, incorrectly granting access.</p> <p>### PoC ```</p> <p>import scitokens import sys</p> <p>def poc_scope_bypass(): &#34;&#34;&#34; Demonstrate an Authorization Bypass vulnerability in scope path checking. &#34;&#34;&#34; print(&#34;--- PoC: Incorrect Scope Path Checking (Authorization Bypass) ---&#34;) issuer = &#34;https://scitokens.org/unittest&#34; enforcer = scitokens.Enforcer(issuer) # Create a token with access to /john token = scitokens.Sc…</p> <p><strong>Affected:</strong> PyPI: scitokens</p> <p>### Summary The `Enforcer` incorrectly validates scope paths by using a simple prefix match (`startswith`). This allows a token with access to a specific path (e.g., `/john`) to also access sibling paths that start with the same prefix (e.g., `/johnathan`, `/johnny`), which is an **Authorization Bypass**.</p> <p>### Details **File:** `src/scitokens/scitokens.py` **Methods:** `_validate_scp` and `_validate_scope`</p> <p>### Vulnerable Code Snippets:</p> <p>**In `_validate_scp` (around line 696):** ```python for scope in value: authz, norm_path = self._check_scope(scope) if (self._test_authz == authz) and norm_requested_path.startswith(norm_path): return True ```</p> <p>**In `_validate_scope` (around line 722):** ```python for scope in value.split(&#34; &#34;): authz, norm_path = self._check_scope(scope) if (self._test_authz == authz) and norm_requested_path.startswith(norm_path): return True ```</p> <p>If `norm_path` (authorized) is `/john` and `norm_requested_path` (requested) is `/johnathan`, `startswith` returns `True`, incorrectly granting access.</p> <p>### PoC ```</p> <p>import scitokens import sys</p> <p>def poc_scope_bypass(): &#34;&#34;&#34; Demonstrate an Authorization Bypass vulnerability in scope path checking. &#34;&#34;&#34; print(&#34;--- PoC: Incorrect Scope Path Checking (Authorization Bypass) ---&#34;) issuer = &#34;https://scitokens.org/unittest&#34; enforcer = scitokens.Enforcer(issuer) # Create a token with access to /john token = scitokens.Sc…</p> https://cve.radiocsirt.org/vuln/ghsa-w8fp-g9rh-34jh https://cve.radiocsirt.org/vuln/opensuse-su-2026:10491-1 <p>python311-scitokens-1.8.1-2.1 on GA media</p> <p>python311-scitokens-1.8.1-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10491-1 https://cve.radiocsirt.org/vuln/pysec-2026-2276 <p><strong>Affected:</strong> PyPI: scitokens</p> <p>SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.</p> <p><strong>Affected:</strong> PyPI: scitokens</p> <p>SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2276