{"id":"CVE-2026-48816","revision":"44cf08d9921b4008ab1b2d6f0a7b6ce9","records":[{"revision":"44cf08d9921b4008ab1b2d6f0a7b6ce9","observedAt":"2026-10-25T12:17:32.273+00:00","statement":{"source":"nvd","id":"CVE-2026-48816","aliases":[],"title":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even thoug…","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.","state":0,"publishedAt":"2026-07-14T21:17:01.497+00:00","modifiedAt":"2026-10-24T21:10:00.13+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/sigstore/sigstore-js/commit/f074710a91ea9260a9ac2142345634579843a3cd","https://github.com/sigstore/sigstore-js/pull/1659","https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Fverify%403.1.1","https://github.com/sigstore/sigstore-js/security/advisories/GHSA-xgjw-pm74-86q4"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48816","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-345"],"productCriteria":[],"sourceDates":{"published":"2026-07-14T21:17:01.497","lastModified":"2026-10-24T21:10:00.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-48816","identifiers":["CVE-2026-48816"]},"retained":false,"historicalAffected":[]}],"coverage":[]}