CVE-2026-32725: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-32725 is a Relative Path Traversal (authorization bypass) vulnerability in the SciTokens C++ library (scitokens-cpp). Prior to version 1.4.1, the library's scope path normalization logic collapses .. path components in token scope claims instead of rejecting them, allowing an authenticated attacker to broaden their effective authorization beyond the intended directory. All tagged releases from v0.1.0 through v1.4.0 are affected. It carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory).

The root cause is classified as CWE-23 (Relative Path Traversal) and CWE-22 (Path Traversal), with an additional CWE-863 (Incorrect Authorization). The vulnerable logic resides in src/scitokens_internal.cpp within the Enforcer::scope_validator and normalize_absolute_path functions. When a token's scope claim contains a path like read:/home/user1/.., the normalizer iterates over path components and pops the last element when it encounters .., silently resolving the traversal rather than rejecting the token. This means read:/home/user1/.. normalizes to /home and read:/anything/.. normalizes to /, and the broadened path is then used for authorization decisions. The fix in commit 7951ed8 introduces a strict scope-path canonicalization function (normalize_scope_path_strict) that rejects any scope path containing .. components, including percent-encoded and double-encoded variants such as %2e%2e and %252e%252e (GitHub Advisory, Fix Commit).

An authenticated attacker holding a legitimately issued token with a restricted path-based scope can craft or obtain a token whose scope claim contains parent-directory traversal sequences, gaining read and write access to sibling directories or even the entire protected namespace. In shared storage environments (e.g., scientific computing clusters using SciTokens for data access), this can break tenant or user directory isolation — for example, a token intended for /home/user1 can be leveraged to access /home/user2, and a token with read:/anything/.. can grant effective global path access, exposing sensitive files such as /etc/passwd (GitHub Advisory).

A proof-of-concept with concrete reproduction steps is publicly available in the GitHub Security Advisory, demonstrating how to craft a token scope to bypass authorization in a real scitokens-cpp deployment. Exploitation requires low privileges (a valid token with any path-based scope) and no user interaction, and is network-accessible. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.0023 (low probability of near-term exploitation) (GitHub Advisory, Feedly).

1. Obtain a valid token: Acquire or create a legitimate SciToken with any path-based scope, e.g., scope=read:/home/user1/... The token must be signed by a trusted issuer accepted by the target enforcer.
2. Identify the target enforcer: Locate a service using scitokens-cpp versions prior to 1.4.1 for authorization (e.g., a data access service in a scientific computing environment).
3. Craft the malicious scope: Set the token's scope claim to include a parent-directory traversal, such as read:/home/user1/.. (to access /home) or read:/anything/.. (to access /, granting global path access). Encoded variants like read:/foo/%2e%2e/bar also work against unpatched versions.
4. Submit the token: Present the crafted token to the enforcer with an authorization request for a resource outside the intended scope, e.g., authorization: read, requested resource: /home/user2 or /etc/passwd.
5. Observe authorization bypass: The enforcer normalizes the scope path, collapsing .. to a broader directory, and incorrectly grants access to the requested resource (GitHub Advisory).

• Logs: Token validation logs showing successful authorization for resources outside the expected directory subtree for a given token; scope claims containing .., %2e%2e, %2E%2e, or %252e%252e in access logs.
• Network: Requests to data access services presenting tokens with scope paths containing traversal sequences (e.g., read:/home/user1/.., read:/anything/..).
• Application Behavior: Unexpected successful access to files or directories (e.g., /home/user2, /etc/passwd) by users whose tokens should be restricted to a different path subtree (GitHub Advisory).

Upgrade scitokens-cpp to version 1.4.1 or later, which introduces strict scope-path canonicalization that rejects any traversal components (including encoded forms) before authorization matching (Fix Commit). As an interim measure, review all deployed SciTokens to ensure scope claims do not contain .. path components, and implement additional application-level validation to reject tokens with traversal sequences in scope paths. No configuration-only workaround is available in unpatched versions; upgrading is the only reliable remediation (GitHub Advisory).

The vulnerability was reported by researcher pmcao and remediated by djw8605 (the library maintainer), with the advisory published on March 30, 2026. Brief community mentions appeared on Mastodon and Bluesky shortly after disclosure, and the issue was indexed by several vulnerability tracking services. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).