CVE-2026-32725 describes a relative path traversal vulnerability (CWE-23) in the scitokens-cpp library before version 1.4.1. The vulnerability arises because the library normalizes scope paths by collapsing parent-directory ('..') components rather than rejecting them, which permits an attacker to manipulate the scope claim in a token to gain broader authorization than intended. This flaw effectively results in an authorization bypass. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high severity, with network attack vector, low attack complexity, requiring low privileges and no user interaction, impacting confidentiality and integrity highly, and availability to a lesser extent. The issue is fixed in version 1.4.1.

Exploitation of this vulnerability allows an attacker with some privileges to bypass authorization controls by crafting token scope claims that include relative path traversal sequences. This can lead to unauthorized access to resources outside the intended directory scope, potentially exposing sensitive data or allowing unauthorized actions. The impact affects confidentiality and integrity significantly, with some impact on availability.

Upgrade scitokens-cpp to version 1.4.1 or later, where this vulnerability has been patched. No other mitigation is required as the fix addresses the root cause by properly handling path normalization and rejecting invalid scope paths.