CVE-2026-48815: sigstore-js Auth Bypass Vulnerability

CVE-2026-48815 Overview

CVE-2026-48815 affects sigstore-js, the JavaScript client libraries for interacting with Sigstore services. In versions prior to 4.1.1, the documented certificateOIDs option passed to sigstore.verify() is accepted by the public API but silently discarded before verification runs. As a result, required certificate extension Object Identifiers (OIDs) are never enforced during signature validation.

Applications that rely on certificateOIDs to restrict which signing certificates may authorize artifacts can accept unauthorized certificates. The flaw is classified as improper verification of a cryptographic signature [CWE-347]. Sigstore released a fix in version 4.1.1.

Critical Impact
Attackers with a valid Sigstore-issued certificate that lacks the required extension OIDs can bypass policy checks and produce signatures that verifying applications accept as authorized.

Affected Products

sigstore-js (sigstore npm package) versions prior to 4.1.1
Applications and CI/CD pipelines using sigstore.verify() with the certificateOIDs option
Downstream toolchains that depend on sigstore-js for artifact verification policy enforcement

Discovery Timeline

2026-07-14 - CVE-2026-48815 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-48815

Vulnerability Analysis

Sigstore uses X.509 certificates issued by Fulcio to bind signing keys to workload or user identities. Callers can constrain which certificates are acceptable by supplying certificateOIDs, a map of extension OIDs to expected values. The verification path is expected to fail if a signing certificate does not carry those extensions.

In affected versions, the option is parsed at the API boundary but never propagated into the verification policy. The verifier proceeds without any OID extension checks. Any Fulcio-issued certificate that otherwise chains correctly satisfies the check, regardless of workload identity, GitHub Actions workflow, or other claims encoded in extensions.

The integrity impact is high because artifact authenticity decisions can be spoofed. Confidentiality and availability are unaffected.

Root Cause

The policy builder in packages/client/src/config.ts populated policy.extensions for the certificate issuer but omitted mapping options.certificateOIDs into policy.oids. Because policy.oids remained empty, the downstream verifier had no OID constraints to evaluate.

Attack Vector

An attacker who can obtain a valid Sigstore signing certificate through the normal OIDC flow can sign a malicious artifact. A verifier configured with certificateOIDs to restrict signatures to a specific workflow, repository, or workload identity will still accept the signature because the OID checks are skipped entirely. No network position or privileges on the target are required beyond obtaining any Fulcio-issued certificate.

typescript

// Security patch in packages/client/src/config.ts (PR #1658)
// The fix adds the missing propagation of certificateOIDs into policy.oids
     policy.extensions = { issuer: options.certificateIssuer };
   }
 
+  if (options.certificateOIDs) {
+    policy.oids = Object.entries(options.certificateOIDs).map(
+      ([oid, value]) => ({
+        oid: { id: oid.split('.').map(Number) },
+        value: Buffer.from(value),
+      })
+    );
+  }
+
   return policy;
 }

Source: sigstore/sigstore-js commit 7845532

Detection Methods for CVE-2026-48815

Indicators of Compromise

Successful sigstore.verify() results for artifacts whose signing certificates lack the extension OIDs your policy requires.
Verified artifacts whose Fulcio certificate SAN, issuer, or workflow OID does not match the expected workload identity.
Build or release events accepting artifacts signed from repositories or workflows outside the approved allowlist.

Detection Strategies

Inventory dependencies on the sigstore npm package and flag any version below 4.1.1 in application manifests, lockfiles, and container images.
Re-verify recently released artifacts using an updated sigstore-js client or cosign with equivalent OID policy to detect signatures that would have been rejected under a correct implementation.
Add unit tests that call sigstore.verify() with a known-bad certificate and confirm rejection when certificateOIDs are set.

Monitoring Recommendations

Log the certificate subject, issuer, and extension OIDs for every verified artifact and alert on values outside the approved set.
Monitor Rekor transparency log entries for signatures produced by identities not authorized to release your software.
Track upgrades of the sigstore package across repositories to confirm the fixed version is deployed everywhere verification is performed.

How to Mitigate CVE-2026-48815

Immediate Actions Required

Upgrade sigstore-js to version 4.1.1 or later in all applications, CI/CD pipelines, and container images.
Audit historical verification results produced with vulnerable versions and re-verify artifacts against the intended certificateOIDs policy.
Rotate or revoke trust in any artifact whose signing identity cannot be confirmed against the required OID policy.

Patch Information

The fix is available in sigstore-js release 4.1.1 via pull request #1658. Details are documented in the GHSA-52v5-jr5w-gjxr security advisory.

Workarounds

Perform verification using an alternate, unaffected client such as cosign that correctly enforces certificate extension OIDs.
Add an explicit post-verification check that parses the returned certificate and asserts required OID extensions before trusting the artifact.
Restrict which OIDC identities can obtain Fulcio certificates for your project to reduce the pool of certificates an attacker could misuse.

bash

# Upgrade to the patched version in Node.js projects
npm install sigstore@^4.1.1

# Verify the installed version
npm ls sigstore

# Audit for vulnerable transitive dependencies
npm audit --production