Medium severity · published Sep 14, 2026
CVE-2026-88819
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Eclipse Data Plane Core · Eclipse Foundation
a6f7d4cc0093931287c349e1e546ad2932c08e8d before 882fe22db42bc67abfd0304c4cdb141b762c35d1; 0.1.0 through 0.1.3 · source: vendor