scitokens
PyPI3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting scitokenspage 1 of 1
- CVE-2026-32714CRITICALCVSS 9.8EG 9.8✓ Fixed in 1.9.62026-03-31
vulnerable: 0.1 ... 1.8.1 (32 versions)
SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied …
- CVE-2026-32716HIGHCVSS 8.1EG 8.1✓ Fixed in 1.9.62026-03-31
vulnerable: 0.1 ... 1.8.1 (32 versions)
SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.…
- CVE-2026-32727HIGHCVSS 8.1EG 8.1✓ Fixed in 1.9.72026-03-31
vulnerable: 0.1 ... 1.9.6 (33 versions)
SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended …
Check whether scitokens is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for scitokens CVEs against the assets you own.
Start Free Scan →