SciTokens C++ validates token scopes by comparing requested resource paths to the authorized scope using a simple string‑prefix check. Because the comparison does not enforce a full path segment boundary, a token that is limited to a specific path can incorrectly be granted access to sibling paths that begin with the same prefix. This allows an attacker who possesses a scoped token to request and receive resources outside its legitimate scope, leading to unauthorized data access.

All releases of the SciTokens C++ library published before version 1.4.1 are affected. The library is known as scitokens:scitokens-cpp. Versions 1.4.1 and later include a fix that enforces proper path segment boundaries and no longer suffer from the bypass.

The vulnerability carries a high severity score of 8.1, indicating a significant impact. Exploitation requires only a legitimately scoped token and does not need additional system compromise. While the probability of exploitation is currently considered low, the potential for unauthorized data access warrants prompt remediation. The issue is not listed in the known exploited vulnerability catalog.