CVE-2026-48816

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48816", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-22T20:57:10.976Z", "datePublished": "2026-07-14T20:39:05.532Z", "dateUpdated": "2026-07-15T14:26:01.060Z"}, "containers": {"cna": {"title": "sigstore-js: Insufficient Verification of Data Authenticity", "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "lang": "en", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4"}, {"name": "https://github.com/sigstore/sigstore-js/pull/1659", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/pull/1659"}, {"name": "https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd"}, {"name": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1"}], "affected": [{"vendor": "sigstore", "product": "sigstore-js", "versions": [{"version": "< 3.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T20:39:05.532Z"}, "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1."}], "source": {"advisory": "GHSA-xgjw-pm74-86q4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T14:25:32.204796Z", "id": "CVE-2026-48816", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T14:26:01.060Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "sigstore-js: Insufficient Verification of Data Authenticity", "source": {"advisory": "GHSA-xgjw-pm74-86q4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "sigstore", "product": "sigstore-js", "versions": [{"status": "affected", "version": "< 3.1.1"}]}], "references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "name": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sigstore/sigstore-js/pull/1659", "name": "https://github.com/sigstore/sigstore-js/pull/1659", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd", "name": "https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1", "name": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T20:39:05.532Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48816", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T14:25:32.204796Z"}}}], "references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-15T14:25:48.825Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-48816", "state": "PUBLISHED", "dateUpdated": "2026-07-14T20:39:05.532Z", "dateReserved": "2026-05-22T20:57:10.976Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-14T20:39:05.532Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sigstore-js", "vendor": "sigstore", "versions": [{"status": "affected", "version": "< 3.1.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1."}, {"lang": "es", "value": "sigstore-js proporciona bibliotecas JavaScript para interactuar con los servicios de Sigstore. Antes de la 3.1.1, @sigstore/verify deriva una marca de tiempo del registro de transparencia de tlogEntries[].integratedTime para entradas de solo prueba de inclusi\u00f3n del paquete v0.2, a pesar de que la ruta de la prueba de inclusi\u00f3n no vincula criptogr\u00e1ficamente integratedTime, permitiendo a un atacante que puede proporcionar un paquete no confiable influir en la validez del certificado y en las decisiones de verificaci\u00f3n de timestampThreshold. Este problema se ha solucionado en la versi\u00f3n 3.1.1."}], "id": "CVE-2026-48816", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48816", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T14:25:32.204796Z", "version": "2.0.3"}}]}, "published": "2026-07-14T21:17:01.497", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/pull/1659"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "sigstore-js: sigstore-js: Insufficient verification of data authenticity allows timestamp manipulation", "id": "2499688", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499688"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-345", "details": ["A flaw was found in sigstore-js. The software derives a transparency-log timestamp from tlogEntries[].integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a transparency log (tlog) entry can be inclusion-proof-only, meaning the inclusion proof path does not cryptographically bind the integratedTime. This allows an attacker who can supply an untrusted bundle to influence time-based verification decisions by choosing an arbitrary integratedTime. This could lead to incorrect validation of certificate validity."], "mitigation": {"lang": "en:us", "value": "Upgrade to the latest sigstore-js release that addresses GHSA-xgjw-pm74-86q4."}, "name": "CVE-2026-48816", "public_date": "2026-07-01T19:58:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48816\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48816\nhttps://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4"], "statement": "A flaw was found in sigstore-js. The tlog integratedTime field is not cryptographically bound in inclusionProof-only bundle v0.2 entries, allowing an attacker who supplies an untrusted bundle to influence time-based verification decisions.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.1.1)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "sigstore-js", "source": "cna", "vendor": "sigstore"}, "product": "sigstore", "vendor": "sigstore"}], "created": "2026-07-17T06:15:04.711966+00:00", "updated": "2026-07-31T05:00:05.724707+00:00", "vendors": ["sigstore", "sigstore$PRODUCT$sigstore"]}