{"action":"Upgrade scitokens to 1.9.6 or later.","affected":[{"fixed":"1.9.6","introduced":"0"}],"component":"scitokens","cve_ids":["CVE-2026-32714"],"ecosystem":"PyPI","epss":0.00492,"exploited":false,"fixed_versions":["1.9.6"],"ghsa_id":"GHSA-rh5m-2482-966c","id":"tcs_01M5KFY1WRN6SF36RV2H09JVEB","modified_at":"2026-06-29T12:26:36.352740692Z","published_at":"2026-03-31T22:49:15Z","references":["https://osv.dev/vulnerability/GHSA-rh5m-2482-966c","https://github.com/scitokens/scitokens/security/advisories/GHSA-rh5m-2482-966c","https://nvd.nist.gov/vuln/detail/CVE-2026-32714","https://github.com/scitokens/scitokens/commit/3dba108853f2f4a6c0f2325c03779bf083c41cf2","https://github.com/scitokens/scitokens","https://github.com/scitokens/scitokens/releases/tag/v1.9.6"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-rh5m-2482-966c","url":"https://osv.dev/vulnerability/GHSA-rh5m-2482-966c"}],"summary":"SciTokens is vulnerable to SQL Injection in KeyCache"}