CVE-2026-48816

Deferred Deferred - Pending Action

Sigstore-js Timestamp Manipulation in Verification

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48816

Affected Vendors & Products

Vendor	Product	Version / Range
sigstore	sigstore-js	3.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability in sigstore-js versions before 3.1.1 allows an attacker to manipulate certificate validity and timestamp checks by supplying a malicious bundle. The issue occurs because the library incorrectly uses tlogEntries[].integratedTime from bundle v0.2 inclusionProof-only entries, which are not cryptographically bound to the proof path.

Detection Guidance

This vulnerability affects @sigstore/verify versions prior to 3.1.1. To detect it, check the installed version of @sigstore/verify in your JavaScript project using commands like 'npm list @sigstore/verify' or 'yarn list @sigstore/verify'. If the version is below 3.1.1, the system is vulnerable.

Impact Analysis

If you use sigstore-js for verifying software artifacts, an attacker could forge timestamps or certificates, leading to false validation of untrusted or malicious bundles. This could allow unauthorized or tampered software to be accepted as legitimate.

Compliance Impact

This vulnerability may undermine compliance with standards requiring software integrity and auditability, such as GDPR's accountability principle or HIPAA's integrity controls, by enabling undetected tampering of software artifacts.

Mitigation Strategies

Update @sigstore/verify to version 3.1.1 or later to address the vulnerability. Review any bundles processed by your system to ensure they are from trusted sources and verify their integrity.

Hi! I’m here to help you understand CVE-2026-48816. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70