A critical authorization bypass vulnerability in the SciTokens library, affecting versions prior to 1.9.6, allows authenticated users to access unauthorized data paths.

The Enforcer component incorrectly uses a simple prefix match to validate scope paths. This flaw allows an authenticated user with access to a specific path to gain unauthorized access to sibling paths that share the same prefix.

This vulnerability poses a significant risk to data confidentiality and integrity by permitting unauthorized access to sensitive information stored in sibling directories. Given the CVSS score of 8.1, the high potential for privilege escalation and unauthorized data access necessitates immediate attention to prevent potential breaches within systems relying on SciTokens for authorization.

Immediate Action: Update the SciTokens library to version 1.9.6 or later to implement the corrected scope validation logic.

Proactive Monitoring: Review audit logs for unusual access patterns, specifically focusing on users requesting access to paths outside their intended scope or directory structure.

Compensating Controls: If immediate patching is not feasible, restrict access to the affected service and ensure that directory structures are not predictable or susceptible to simple prefix manipulation.

Public Exploit Available: Unknown.

The authorization bypass in SciTokens represents a high-severity risk to system security. Organizations utilizing this library must prioritize upgrading to version 1.9.6 to remediate the logic flaw and restore proper access control enforcement. Failure to update may leave sensitive data exposed to unauthorized users.