Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

scitokens

3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
1.9.7 (Mar 13, 2026): no advisory affects it
Newest unaffected release
1.9.7 (Mar 13, 2026), the latest release
Advisories
3 · 1 critical, 2 high
Weekly downloads
21.4K
Dependents
213
Releases
34 since 0.1.0 (Sep 13, 2017)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • SciTokens: Authorization Bypass via Path Traversal in Scope Validation

    Affected: fixed in 1.9.7.

    Fixed in 1.9.7 (released Mar 13, 2026, 18 days before disclosure).

    The latest release, 1.9.7, is not affected.

  • SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking

    Affected: fixed in 1.9.6.

    Fixed in 1.9.6 (released Mar 13, 2026, 18 days before disclosure).

    The latest release, 1.9.7, is not affected.

  • CVE-2026-32714Critical 9.8

    SciTokens vulnerable to SQL Injection in KeyCache

    Affected: fixed in 1.9.6.

    Fixed in 1.9.6 (released Mar 13, 2026, 18 days before disclosure).

    The latest release, 1.9.7, is not affected.