What’s Vulnerable › Vulnerabilities

CVE-2026-24408: sigstore has CSRF possibility in OIDC authentication during signing

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-26 · updated 2026-06-17
• Weakness: CWE-352

Description

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. `_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value. Version 4.2.0 contains a patch for the issue.

Affected products

• sigstore-python: before 4.2.0 — fixed in 4.2.0

How to fix

Upgrade to a fixed version: sigstore-python 4.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/sigstore/sigstore-python/commit/5e77497fe8f0b202bdd118949074ec2f20da69aa
• https://github.com/sigstore/sigstore-python/releases/tag/v4.2.0
• https://github.com/sigstore/sigstore-python/security/advisories/GHSA-hm8f-75xx-w2vr

Get alerted when CVE-2026-24408 or the next vulnerability affects your stack