Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M

CVE-2026-48816sigstore-js: Insufficient Verification of Data Authenticity

Medium 6.5

In plain English

A medium-severity insufficient verification of data authenticity in sigstore-js from sigstore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@sigstore/verify	3.1.1	GHSA-xgjw-pm74-86q4

Affected products (as reported)

Vendor	Product	Versions
sigstore	sigstore-js	< 3.1.1

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4 x_refsource_CONFIRM
https://github.com/sigstore/sigstore-js/pull/1659 x_refsource_MISC
https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd x_refsource_MISC
https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1 x_refsource_MISC