CVE-2026-48816

MEDIUM 6.5

sigstore-js: Insufficient Verification of Data Authenticity

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.

CWE	CWE-345
Vendor	sigstore
Product	sigstore-js
Published	Jul 14, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for sigstore sigstore-js

Be the first to know when new medium vulnerabilities affecting sigstore sigstore-js are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

sigstore / sigstore-js

< 3.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4 github.com: https://github.com/sigstore/sigstore-js/pull/1659 github.com: https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd github.com: https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1