CVE-2026-48815

A flaw was found in sigstore. The certificateOIDs option, intended to restrict which certificates can sign artifacts, is accepted by the public application programming interface (API) but is not used during the verification process. This allows unauthorized certificates to be accepted, bypassing security policies that rely on specific certificate extension object identifiers (OIDs). As a result, applications that depend on this option for security receive no protection, potentially leading to the acceptance of malicious or untrusted artifacts.

A flaw was found in the sigstore npm package. The certificateOIDs verification option is accepted by the API but silently discarded before verification, meaning required certificate extension OIDs are never enforced.

Any such call on sigstore <= 4.1.0 should be treated as if the certificateOIDs block was never there:

await sigstore.verify(bundle, payload, {
  certificateIssuer: "...",
  certificateIdentityEmail: "...",
  certificateOIDs: {
    "1.3.6.1.4.1.57264.1.9": "expected-value",
  },
});

In order to be affected by the vulnerability, an application must use the sigstore.verify() function with certificateOIDs option.

Note: The CVSS has been adjusted with AC:H, due to it's low real-world exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to sigstore 4.1.1 or later.

The majority of products have sigstore-js as a transitive dependency from the npm v10.9.7 package.

sh-5.1$ npm ls sigstore
[email protected] /usr/lib/node_modules/npm
+-- @npmcli/[email protected]
| `-- @npmcli/[email protected]
|   `-- [email protected]
|     `-- [email protected] deduped
+-- [email protected]
| `-- [email protected]
`-- [email protected]
  `-- [email protected] deduped