PYSEC-2026-2276

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/scitokens/PYSEC-2026-2276.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-2276

Aliases

Published

2026-03-31T03:15:57.143Z

Modified

2026-07-13T07:15:42.279003548Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /john) to also access sibling paths that start with the same prefix (e.g., /johnathan, /johnny), which is an Authorization Bypass. This issue has been patched in version 1.9.6.

References

Affected packages

PyPI / scitokens

Package

Name: scitokens; View open source insights on deps.dev
Purl: pkg:pypi/scitokens

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.6

Affected versions

0.*

0.1

0.1.1

0.1.3

0.1.4

0.1.5

0.1.6

0.2.1

0.2.2

0.3.0

0.3.1

0.3.2

0.3.3

1.*

1.0.0

1.0.1

1.0.2

1.1.0

1.1.1

1.2.0

1.2.1

1.2.2

1.2.4

1.3.1

1.4.0

1.5.0

1.6.0

1.6.2

1.7.0

1.7.1

1.7.2

1.7.4

1.8.0

1.8.1

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/scitokens/PYSEC-2026-2276.yaml"