CVE-2026-48815

Deferred Deferred - Pending Action

sigstore-js CertificateOID Verification Bypass

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48815

Affected Vendors & Products

Vendor	Product	Version / Range
sigstore	sigstore-js	to 4.1.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

The vulnerability in sigstore-js before version 4.1.1 involves the certificateOIDs option in sigstore.verify(). This option is accepted by the API but ignored during verification, meaning required certificate extensions are never checked. Applications using this option to restrict certificate usage may accept unauthorized certificates.

Detection Guidance

To detect this vulnerability, check the installed version of sigstore-js in your project using npm list sigstore or npm list -g sigstore. If the version is below 4.1.1, the application is vulnerable. Update to version 4.1.1 or later to mitigate the issue.

Impact Analysis

If you rely on certificateOIDs to restrict which certificates can sign artifacts, this vulnerability could allow unauthorized certificates to sign artifacts. This may lead to accepting malicious or unintended artifacts as valid.

Compliance Impact

This vulnerability could impact compliance with standards like GDPR and HIPAA by allowing unauthorized certificates to sign artifacts, potentially leading to improper access or data integrity issues if applications rely on certificateOIDs for restrictions.

Mitigation Strategies

Update sigstore-js to version 4.1.1 or later to ensure certificateOIDs are properly verified during the verification process.

Hi! I’m here to help you understand CVE-2026-48815. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70