CVE-2026-48815CWE-347

sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced

High · published July 14, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
8.2
In the wild
Unconfirmed
What it is

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00190 · 8.2th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-07-14T20:27Z
EPSS history
Timeline
  • 14 JUL 20:27Z
    sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
    cvelistv5