Medium severity · published Jul 14, 2026
CVE-2026-48816
sigstore-js: Insufficient Verification of Data Authenticity
6.5
CVSS
0.1%
EPSS
No
On KEV
Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
sigstore-js · sigstore
< 3.1.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48816
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48816
github.com
https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd
github.com
https://github.com/sigstore/sigstore-js/pull/1659
github.com
https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1
github.com
https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4
More from sigstore-js
9.6
CVE-2026-59891
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
7.5
CVE-2026-48815
sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
5.4
CVE-2026-48758
sigstore-js: DSSE payloadType type-binding failure