CVE-2026-48815: sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-14 · updated 2026-10-24
Weakness: CWE-347

Description

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.

Affected products

sigstore-js: before 4.1.1

References

https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b
https://github.com/sigstore/sigstore-js/pull/1658
https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1
https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr
https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr

Get alerted when CVE-2026-48815 or the next vulnerability affects your stack