High severity · published Jul 14, 2026
CVE-2026-48815
sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
sigstore-js · sigstore
< 4.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48815
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48815
github.com
https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b
github.com
https://github.com/sigstore/sigstore-js/pull/1658
github.com
https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1
github.com
https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr
More from sigstore-js
9.6
CVE-2026-59891
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
6.5
CVE-2026-48816
sigstore-js: Insufficient Verification of Data Authenticity
5.4
CVE-2026-48758
sigstore-js: DSSE payloadType type-binding failure