CVE-2026-48815

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48815
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48815.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48815
Aliases
Downstream
Related
Published
2026-07-14T20:27:16.925Z
Modified
2026-07-17T03:41:41.908096912Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced
Details

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.

Database specific 
{
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48815.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/sigstore/sigstore-js

Affected ranges

Type
GIT
Repo
https://github.com/sigstore/sigstore-js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7845532f9d17f6f765363dbee82b01bd159fb52b
Fixed
c1dc7d4778a450787fc72b083f2490ad02b714c6
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.1.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

@sigstore/bundle@1.*
@sigstore/bundle@1.0.0
@sigstore/bundle@1.1.0
@sigstore/bundle@2.*
@sigstore/bundle@2.0.0
@sigstore/bundle@2.1.0
@sigstore/bundle@2.1.1
@sigstore/bundle@2.2.0
@sigstore/bundle@2.3.0
@sigstore/bundle@2.3.1
@sigstore/bundle@2.3.2
@sigstore/bundle@3.*
@sigstore/bundle@3.0.0
@sigstore/bundle@3.1.0
@sigstore/bundle@4.*
@sigstore/bundle@4.0.0
@sigstore/cli@0.*
@sigstore/cli@0.0.2
@sigstore/cli@0.0.3
@sigstore/cli@0.0.4
@sigstore/cli@0.0.5
@sigstore/cli@0.1.0
@sigstore/cli@0.1.1
@sigstore/cli@0.1.2
@sigstore/cli@0.2.0
@sigstore/cli@0.2.1
@sigstore/cli@0.3.0
@sigstore/cli@0.4.0
@sigstore/cli@0.5.0
@sigstore/cli@0.6.0
@sigstore/cli@0.7.0
@sigstore/cli@0.7.1
@sigstore/cli@0.8.0
@sigstore/cli@0.8.1
@sigstore/cli@0.8.2
@sigstore/cli@0.9.0
@sigstore/cli@0.9.1
@sigstore/core@0.*
@sigstore/core@0.1.0
@sigstore/core@0.2.0
@sigstore/core@1.*
@sigstore/core@1.0.0
@sigstore/core@1.1.0
@sigstore/core@2.*
@sigstore/core@2.0.0
@sigstore/core@3.*
@sigstore/core@3.0.0
@sigstore/core@3.2.0
@sigstore/mock@0.*
@sigstore/mock@0.1.0
@sigstore/mock@0.1.1
@sigstore/mock@0.10.0
@sigstore/mock@0.11.0
@sigstore/mock@0.12.0
@sigstore/mock@0.2.0
@sigstore/mock@0.3.0
@sigstore/mock@0.4.0
@sigstore/mock@0.5.0
@sigstore/mock@0.6.0
@sigstore/mock@0.6.1
@sigstore/mock@0.6.2
@sigstore/mock@0.6.3
@sigstore/mock@0.6.4
@sigstore/mock@0.6.5
@sigstore/mock@0.7.0
@sigstore/mock@0.7.1
@sigstore/mock@0.7.2
@sigstore/mock@0.7.3
@sigstore/mock@0.7.4
@sigstore/mock@0.7.5
@sigstore/mock@0.8.0
@sigstore/mock@0.9.0
@sigstore/oci@0.*
@sigstore/oci@0.1.0
@sigstore/oci@0.2.0
@sigstore/oci@0.3.0
@sigstore/oci@0.3.1
@sigstore/oci@0.3.2
@sigstore/oci@0.3.3
@sigstore/oci@0.3.4
@sigstore/oci@0.3.5
@sigstore/oci@0.3.6
@sigstore/oci@0.3.7
@sigstore/oci@0.4.0
@sigstore/oci@0.5.0
@sigstore/oci@0.6.0
@sigstore/oci@0.6.1
@sigstore/rekor-types@0.*
@sigstore/rekor-types@0.0.2
@sigstore/rekor-types@0.0.3
@sigstore/rekor-types@1.*
@sigstore/rekor-types@1.0.0
@sigstore/rekor-types@2.*
@sigstore/rekor-types@2.0.0
@sigstore/rekor-types@3.*
@sigstore/rekor-types@3.0.0
@sigstore/rekor-types@4.*
@sigstore/rekor-types@4.0.0
@sigstore/sign@1.*
@sigstore/sign@1.0.0
@sigstore/sign@2.*
@sigstore/sign@2.0.0
@sigstore/sign@2.1.0
@sigstore/sign@2.2.0
@sigstore/sign@2.2.1
@sigstore/sign@2.2.2
@sigstore/sign@2.2.3
@sigstore/sign@2.3.0
@sigstore/sign@2.3.1
@sigstore/sign@2.3.2
@sigstore/sign@3.*
@sigstore/sign@3.0.0
@sigstore/sign@3.1.0
@sigstore/sign@4.*
@sigstore/sign@4.0.0
@sigstore/sign@4.0.1
@sigstore/sign@4.1.1
@sigstore/tuf@1.*
@sigstore/tuf@1.0.0
@sigstore/tuf@1.0.1
@sigstore/tuf@1.0.2
@sigstore/tuf@1.0.3
@sigstore/tuf@2.*
@sigstore/tuf@2.0.0
@sigstore/tuf@2.1.0
@sigstore/tuf@2.2.0
@sigstore/tuf@2.3.0
@sigstore/tuf@2.3.1
@sigstore/tuf@2.3.2
@sigstore/tuf@2.3.3
@sigstore/tuf@2.3.4
@sigstore/tuf@3.*
@sigstore/tuf@3.0.0
@sigstore/tuf@3.1.0
@sigstore/tuf@3.1.1
@sigstore/tuf@4.*
@sigstore/tuf@4.0.0
@sigstore/tuf@4.0.2
@sigstore/verify@0.*
@sigstore/verify@0.1.0
@sigstore/verify@1.*
@sigstore/verify@1.0.0
@sigstore/verify@1.1.0
@sigstore/verify@1.1.1
@sigstore/verify@1.2.0
@sigstore/verify@1.2.1
@sigstore/verify@2.*
@sigstore/verify@2.0.0
@sigstore/verify@2.1.0
@sigstore/verify@2.1.1
@sigstore/verify@3.*
@sigstore/verify@3.0.0
sigstore@1.*
sigstore@1.5.1
sigstore@1.5.2
sigstore@1.6.0
sigstore@1.7.0
sigstore@1.8.0
sigstore@1.9.0
sigstore@2.*
sigstore@2.0.0
sigstore@2.1.0
sigstore@2.2.0
sigstore@2.2.1
sigstore@2.2.2
sigstore@2.3.0
sigstore@2.3.1
sigstore@3.*
sigstore@3.0.0
sigstore@3.1.0
sigstore@4.*
sigstore@4.0.0
sigstore@4.1.0
v0.*
v0.0.1-alpha.5
v0.1.0
v0.1.1
v0.2.0
v0.3.0
v0.4.0
v1.*
v1.0.0
v1.0.0-beta.1
v1.1.0
v1.1.1
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.4.0
v1.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48815.json"