A critical authorization bypass vulnerability in the SciTokens C++ library allows authenticated users to access unauthorized resources via manipulated path requests.

The library performs authorization checks using an insecure string-prefix comparison that fails to enforce path-segment boundaries. Consequently, an authenticated attacker can bypass intended access controls to gain unauthorized access to sibling resource paths.

The vulnerability poses a high risk to data confidentiality and integrity, as reflected by the CVSS score of 8.1. Successful exploitation allows unauthorized users to access, and potentially modify, sensitive data that should be restricted to specific service scopes. This could lead to significant data breaches or unauthorized administrative actions within systems utilizing the library for token validation.

Immediate Action: Update the SciTokens C++ library to version 1.4.1 or later to implement secure path-segment boundary validation.

Proactive Monitoring: Review application access logs for unusual path traversal patterns or access requests that deviate from established user scopes.

Compensating Controls: Deploy Web Application Firewall rules to strictly validate and normalize request paths, preventing potential attempts to manipulate resource access via prefix-based bypasses.

Public Exploit Available: No

Given the high CVSS score and the existence of a proof-of-concept, organizations should prioritize upgrading their SciTokens C++ dependency. Failure to patch allows for a direct bypass of security scopes, undermining the primary authorization mechanism of the affected applications. Immediate deployment of the 1.4.1 release is required to close this security gap.