CVE-2026-88819: Siglet Authentication Bypass Vulnerability

CVE-2026-88819 Overview

CVE-2026-88819 is an authentication weakness in Siglet where the refresh token handler does not enforce proof of possession of the issuer Decentralized Identifier (DID). The flaw affects current and past versions of Siglet, an Eclipse Foundation project. The weakness is classified under [CWE-290] (Authentication Bypass by Spoofing), enabling an attacker on the network to request refreshed tokens without demonstrating control of the DID that issued the original credential.

Critical Impact
An unauthenticated network attacker can obtain refreshed access tokens without proving ownership of the issuer DID, undermining the trust guarantees of the DID-based authentication flow.

Affected Products

Siglet (Eclipse Foundation project)
All current released versions of Siglet
Prior versions of Siglet with refresh token support

Discovery Timeline

2026-09-14 - CVE-2026-88819 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-88819

Vulnerability Analysis

Siglet issues tokens tied to a Decentralized Identifier (DID) belonging to the issuer. The refresh token handler is expected to validate that the entity requesting a refresh controls the private key material associated with the issuer DID. In vulnerable builds, this proof-of-possession check is absent. An attacker who obtains or presents a refresh token can exchange it for a new access token without demonstrating cryptographic control of the DID. This breaks a core assumption of DID-based authentication: that token holders must prove they still possess the keys binding them to the identifier.

Root Cause

The root cause is a missing verification step in the refresh token endpoint. The handler accepts the refresh request and returns new tokens without challenging the requester to sign a nonce or produce another cryptographic artifact tied to the issuer DID's private key. This maps to [CWE-290] because the server trusts an identity claim without confirming the claimant controls the underlying credential.

Attack Vector

The attack requires network access to the Siglet token refresh endpoint. Because no user interaction and no prior privileges are required, any party able to reach the endpoint and present a refresh token can invoke the flow. Exploitation complexity is elevated because the attacker must first acquire a valid refresh token through interception, log exposure, or another leakage channel. Once obtained, the token can be replayed to mint fresh access tokens indefinitely, bypassing the DID binding that would otherwise constrain reuse.

No public proof-of-concept code is available. Refer to the Eclipse GitLab Vulnerability Report #931 for the maintainer's technical description.

Detection Methods for CVE-2026-88819

Indicators of Compromise

Refresh token requests from source IP addresses that do not match the original token issuance IP or client fingerprint.
Successful token refresh events where the requester fails to present a valid DID proof-of-possession artifact.
Anomalous spikes in refresh token issuance for a single subject DID within a short window.

Detection Strategies

Enable verbose logging on the Siglet token endpoint and correlate refresh events with the originating authentication session.
Compare the issuer DID claim in refresh requests against expected key-binding metadata for the tenant.
Alert on refresh token reuse across disparate client identifiers or geolocations.

Monitoring Recommendations

Ingest Siglet authentication logs into a centralized SIEM or data lake for longitudinal analysis.
Track the ratio of refresh operations to initial authentications per DID; sustained deviations warrant investigation.
Monitor upstream identity relying parties for unexpected token acceptance from previously dormant DIDs.

How to Mitigate CVE-2026-88819

Immediate Actions Required

Review the Eclipse GitLab Vulnerability Report #931 for the maintainer's patch guidance and upgrade to a fixed release once published.
Rotate and invalidate outstanding refresh tokens issued by affected Siglet deployments.
Restrict network exposure of the Siglet token endpoint to trusted client networks pending remediation.

Patch Information

The Eclipse Foundation maintains the advisory in Eclipse GitLab Vulnerability Report #931. Consult the report for the fixed version identifier and upgrade steps. The corrected code must enforce proof of possession of the issuer DID's private key during every refresh operation.

Workarounds

Shorten refresh token lifetimes to reduce the window in which a leaked token can be replayed.
Enforce mutual TLS or client certificate authentication on the token endpoint as a compensating control.
Require re-authentication rather than silent token refresh for sensitive relying-party actions until patched.

bash

# Configuration example
# See the Eclipse Siglet advisory for the definitive remediation configuration.
# Refer to https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/931