CVE-2026-48816
Description
A flaw was found in sigstore-js. The software derives a transparency-log timestamp from tlogEntries[].integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a transparency log (tlog) entry can be inclusion-proof-only, meaning the inclusion proof path does not cryptographically bind the integratedTime. This allows an attacker who can supply an untrusted bundle to influence time-based verification decisions by choosing an arbitrary integratedTime. This could lead to incorrect validation of certificate validity.
Statement
A flaw was found in sigstore-js. The tlog integratedTime field is not cryptographically bound in inclusionProof-only bundle v0.2 entries, allowing an attacker who supplies an untrusted bundle to influence time-based verification decisions.
Mitigation
Upgrade to the latest sigstore-js (>= 3.1.1) release that addresses GHSA-xgjw-pm74-86q4.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Varies by Context; Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
