{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48815", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-22T20:57:10.976Z", "datePublished": "2026-07-14T20:27:16.925Z", "dateUpdated": "2026-07-15T12:56:29.848Z"}, "containers": {"cna": {"title": "sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced", "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "lang": "en", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"}, {"name": "https://github.com/sigstore/sigstore-js/pull/1658", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/pull/1658"}, {"name": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b"}, {"name": "https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1"}], "affected": [{"vendor": "sigstore", "product": "sigstore-js", "versions": [{"version": "< 4.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T20:27:16.925Z"}, "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1."}], "source": {"advisory": "GHSA-52v5-jr5w-gjxr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T12:56:21.913994Z", "id": "CVE-2026-48815", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T12:56:29.848Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced", "source": {"advisory": "GHSA-52v5-jr5w-gjxr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "sigstore", "product": "sigstore-js", "versions": [{"status": "affected", "version": "< 4.1.1"}]}], "references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "name": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/sigstore/sigstore-js/pull/1658", "name": "https://github.com/sigstore/sigstore-js/pull/1658", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "name": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1", "name": "https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T20:27:16.925Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48815", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T12:56:21.913994Z"}}}], "references": [{"url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-07-15T12:56:12.729Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-48815", "state": "PUBLISHED", "dateUpdated": "2026-07-14T20:27:16.925Z", "dateReserved": "2026-05-22T20:57:10.976Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-14T20:27:16.925Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "sigstore-js", "vendor": "sigstore", "versions": [{"status": "affected", "version": "< 4.1.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1."}], "id": "CVE-2026-48815", "lastModified": "2026-07-15T20:23:47.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48815", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T12:56:21.913994Z", "version": "2.0.3"}}]}, "published": "2026-07-14T21:17:01.370", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/pull/1658"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "sigstore: Sigstore: Unauthorized certificates accepted due to ignored `certificateOIDs` verification option", "id": "2499687", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499687"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-345", "details": ["A flaw was found in sigstore. The `certificateOIDs` option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface (API) but is not used during the verification process. This allows unauthorized certificates to be accepted, bypassing security policies that rely on specific certificate extension object identifiers (OIDs). As a result, applications that depend on this option for security receive no protection, potentially leading to the acceptance of malicious or untrusted artifacts."], "mitigation": {"lang": "en:us", "value": "Upgrade to sigstore 4.1.1 or later."}, "name": "CVE-2026-48815", "public_date": "2026-07-01T19:58:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-48815\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48815\nhttps://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"], "statement": "A flaw was found in the sigstore npm package. The certificateOIDs verification option is accepted by the API but silently discarded before verification, meaning required certificate extension OIDs are never enforced.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.1.1)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "sigstore-js", "source": "cna", "vendor": "sigstore"}, "product": "sigstore", "vendor": "sigstore"}], "created": "2026-07-16T02:00:03.588797+00:00", "updated": "2026-07-31T05:00:05.729869+00:00", "vendors": ["sigstore", "sigstore$PRODUCT$sigstore"]}