| Package | Affected versions | Patched versions |
|---|---|---|
| scitokens cpp library | < 1.4.1 | 1.4.1 |
SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses ".." path components instead of rejecting them. As a result, an attacker can use parent-directory traversal in the scope claim to broaden the effective authorization beyond the intended directory. This issue has been patched in version 1.4.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free