CVE-2026-48815

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48815", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-22T20:57:10.976Z", "datePublished": "2026-07-14T20:27:16.925Z", "dateUpdated": "2026-07-15T12:56:29.848Z"}, "containers": {"cna": {"title": "sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced", "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"}, {"name": "https://github.com/sigstore/sigstore-js/pull/1658", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/pull/1658"}, {"name": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b"}, {"name": "https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1"}], "affected": [{"vendor": "sigstore", "product": "sigstore-js", "versions": [{"version": "< 4.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T20:27:16.925Z"}, "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1."}], "source": {"advisory": "GHSA-52v5-jr5w-gjxr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T12:56:21.913994Z", "id": "CVE-2026-48815", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T12:56:29.848Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced", "source": {"advisory": "GHSA-52v5-jr5w-gjxr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "sigstore", "product": "sigstore-js", "versions": [{"status": "affected", "version": "< 4.1.1"}]}], "references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "name": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sigstore/sigstore-js/pull/1658", "name": "https://github.com/sigstore/sigstore-js/pull/1658", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "name": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1", "name": "https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T20:27:16.925Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48815", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T12:56:21.913994Z"}}}], "references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-15T12:56:12.729Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-48815", "state": "PUBLISHED", "dateUpdated": "2026-07-14T20:27:16.925Z", "dateReserved": "2026-05-22T20:57:10.976Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-14T20:27:16.925Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sigstore-js", "vendor": "sigstore", "versions": [{"status": "affected", "version": "< 4.1.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1."}, {"lang": "es", "value": "sigstore-js proporciona bibliotecas JavaScript para interactuar con los servicios Sigstore. Antes de la versi\u00f3n 4.1.1, la opci\u00f3n documentada certificateOIDs en sigstore.verify() es aceptada por la API p\u00fablica pero descartada antes de la verificaci\u00f3n, por lo que los OID de extensi\u00f3n de certificado requeridos nunca se verifican y las aplicaciones que dependen de certificateOIDs para restringir qu\u00e9 certificados pueden firmar artefactos pueden aceptar certificados no autorizados. Este problema se corrige en la versi\u00f3n 4.1.1."}], "id": "CVE-2026-48815", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48815", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T12:56:21.913994Z", "version": "2.0.3"}}]}, "published": "2026-07-14T21:17:01.370", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/pull/1658"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "sigstore: Sigstore: Unauthorized certificates accepted due to ignored `certificateOIDs` verification option", "id": "2499687", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499687"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-345", "details": ["A flaw was found in sigstore. The `certificateOIDs` option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface (API) but is not used during the verification process. This allows unauthorized certificates to be accepted, bypassing security policies that rely on specific certificate extension object identifiers (OIDs). As a result, applications that depend on this option for security receive no protection, potentially leading to the acceptance of malicious or untrusted artifacts."], "mitigation": {"lang": "en:us", "value": "Upgrade to sigstore 4.1.1 or later."}, "name": "CVE-2026-48815", "public_date": "2026-07-01T19:58:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48815\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48815\nhttps://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"], "statement": "A flaw was found in the sigstore npm package. The certificateOIDs verification option is accepted by the API but silently discarded before verification, meaning required certificate extension OIDs are never enforced.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.1.1)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "sigstore-js", "source": "cna", "vendor": "sigstore"}, "product": "sigstore", "vendor": "sigstore"}], "created": "2026-07-16T02:00:03.588797+00:00", "updated": "2026-07-31T05:00:05.729869+00:00", "vendors": ["sigstore", "sigstore$PRODUCT$sigstore"]}