PYSEC-2026-1924

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/sigstore/PYSEC-2026-1924.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-1924
Aliases
Published
2026-07-07T16:03:20.418491Z
Modified
2026-07-07T17:47:52.920906253Z
Severity
  • 0.0 (None) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N CVSS Calculator
Summary
sigstore CSRF possibility in OIDC authentication during signing
Details

Summary

The sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery.

Details

_OAuthSession creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value.

Fix should be fairly trivial.

Impact

This should be low impact: A man-in-the middle attacker could trick a sigstore-python user into signing something with an identity controlled by the attacker (by returning the response to an authentication request they created). This would be quite confusing but not dangerous.

References

Affected packages

PyPI / sigstore

Package

Name
sigstore
View open source insights on deps.dev
Purl
pkg:pypi/sigstore

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.0

Affected versions

0.*
0.0.1rc1
0.0.1rc2
0.0.1rc3
0.1.0
0.2.0
0.3.1
0.4.0
0.4.1
0.4.2
0.5.0
0.5.1rc1
0.5.1rc2
0.5.1
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.7.0
0.8.3
0.9.0
0.10.0
1.*
1.0.0rc1
1.0.0
1.1.0
1.1.1rc1
1.1.1
1.1.2rc1
1.1.2
2.*
2.0.0rc1
2.0.0rc2
2.0.0rc3
2.0.0
2.0.1
2.1.0
2.1.2
2.1.3
2.1.5
3.*
3.0.0rc1
3.0.0rc2
3.0.0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.5.1
3.5.3
3.5.6
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.6.7
4.*
4.0.0
4.1.0

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/sigstore/PYSEC-2026-1924.yaml"