CVE-2026-48815
Last modified
CVE-2026-48815 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| sigstore | sigstore-js | < 4.1.1 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-48815?
How severe is CVE-2026-48815?
How do I fix CVE-2026-48815?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-4881In affected versions of Octopus Server, permissions were not…6.5
- CVE-2026-48810FreeScout is a free help desk and shared inbox built with PH…4.3
- CVE-2026-48811FreeScout is a free help desk and shared inbox built with PH…4.3
- CVE-2026-48812FreeScout is a free help desk and shared inbox built with PH…7.5
- CVE-2026-48813Flawfinder is a a static analysis tool for finding vulnerabi…8.7
- CVE-2026-48814Network-AI is a TypeScript/Node.js multi-agent orchestrator.…9.1
- CVE-2026-48816sigstore-js provides JavaScript libraries for interacting wi…6.5
- CVE-2026-48817Starlette is a lightweight ASGI framework/toolkit. In versio…5.3
- CVE-2026-48818Starlette is a lightweight ASGI framework/toolkit. In versio…7.5
- CVE-2026-48819Hey API is an ecosystem for turning API specifications into …4.8
- CVE-2026-4882The User Registration Advanced Fields plugin for WordPress i…9.8
- CVE-2026-48820CakePHP is a rapid development framework for PHP. In version…6.3
Are you affected by CVE-2026-48815?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST