CVE-2026-88819CWE-290CWE-345

CVE-2026-88819

published September 14, 2026

CVSS
6.3
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00169 · 6.0th percentile
Weaknesses
CWE-290 · Authentication Bypass by Spoofing; CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-09-14T20:17Z
References (1)
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/931 · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 15:32Z
    In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID
    cvelistv5