{"id":"CVE-2026-48815","summary":"sigstore-js: `certificateOIDs` verification constraints are silently dropped and never enforced","details":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1.","aliases":["GHSA-52v5-jr5w-gjxr"],"modified":"2026-07-17T03:41:41.908096912Z","published":"2026-07-14T20:27:16.925Z","related":["CGA-52qc-cr59-fvf7"],"database_specific":{"cwe_ids":["CWE-347"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48815.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/sigstore/sigstore-js/releases/tag/sigstore%404.1.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48815.json"},{"type":"ADVISORY","url":"https://github.com/sigstore/sigstore-js/security/advisories/GHSA-52v5-jr5w-gjxr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48815"},{"type":"FIX","url":"https://github.com/sigstore/sigstore-js/commit/7845532f9d17f6f765363dbee82b01bd159fb52b"},{"type":"FIX","url":"https://github.com/sigstore/sigstore-js/pull/1658"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sigstore/sigstore-js","events":[{"introduced":"0"},{"fixed":"7845532f9d17f6f765363dbee82b01bd159fb52b"},{"fixed":"c1dc7d4778a450787fc72b083f2490ad02b714c6"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.1.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["@sigstore/tuf@4.0.2","@sigstore/sign@4.1.1","@sigstore/oci@0.6.1","@sigstore/mock@0.12.0","@sigstore/core@3.2.0","@sigstore/cli@0.9.1","sigstore@4.1.0","@sigstore/sign@4.0.1","sigstore@4.0.0","@sigstore/verify@3.0.0","@sigstore/tuf@4.0.0","@sigstore/sign@4.0.0","@sigstore/rekor-types@4.0.0","@sigstore/oci@0.6.0","@sigstore/mock@0.11.0","@sigstore/core@3.0.0","@sigstore/cli@0.9.0","@sigstore/bundle@4.0.0","@sigstore/verify@2.1.1","@sigstore/tuf@3.1.1","@sigstore/oci@0.5.0","@sigstore/cli@0.8.2","sigstore@3.1.0","@sigstore/verify@2.1.0","@sigstore/tuf@3.1.0","@sigstore/sign@3.1.0","@sigstore/mock@0.10.0","@sigstore/bundle@3.1.0","@sigstore/mock@0.9.0","sigstore@3.0.0","@sigstore/verify@2.0.0","@sigstore/tuf@3.0.0","@sigstore/sign@3.0.0","@sigstore/rekor-types@3.0.0","@sigstore/oci@0.4.0","@sigstore/mock@0.8.0","@sigstore/core@2.0.0","@sigstore/cli@0.8.1","@sigstore/bundle@3.0.0","@sigstore/oci@0.3.7","@sigstore/oci@0.3.6","@sigstore/oci@0.3.5","@sigstore/mock@0.7.5","@sigstore/oci@0.3.4","sigstore@2.3.1","@sigstore/verify@1.2.1","@sigstore/tuf@2.3.4","@sigstore/sign@2.3.2","@sigstore/oci@0.3.3","@sigstore/mock@0.7.4","@sigstore/bundle@2.3.2","@sigstore/oci@0.3.2","@sigstore/tuf@2.3.3","@sigstore/sign@2.3.1","@sigstore/oci@0.3.1","@sigstore/mock@0.7.3","@sigstore/cli@0.8.0","sigstore@2.3.0","@sigstore/verify@1.2.0","@sigstore/bundle@2.3.1","@sigstore/sign@2.3.0","@sigstore/oci@0.3.0","@sigstore/mock@0.7.2","@sigstore/cli@0.7.1","@sigstore/bundle@2.3.0","@sigstore/verify@1.1.1","@sigstore/tuf@2.3.2","@sigstore/mock@0.7.1","@sigstore/core@1.1.0","@sigstore/oci@0.2.0","@sigstore/mock@0.7.0","@sigstore/cli@0.7.0","sigstore@2.2.2","@sigstore/verify@1.1.0","@sigstore/tuf@2.3.1","@sigstore/sign@2.2.3","@sigstore/mock@0.6.5","@sigstore/bundle@2.2.0","@sigstore/oci@0.1.0","sigstore@2.2.1","@sigstore/verify@1.0.0","@sigstore/sign@2.2.2","@sigstore/mock@0.6.4","@sigstore/core@1.0.0","sigstore@2.2.0","@sigstore/verify@0.1.0","@sigstore/tuf@2.3.0","@sigstore/sign@2.2.1","@sigstore/mock@0.6.3","@sigstore/core@0.2.0","@sigstore/cli@0.6.0","@sigstore/bundle@2.1.1","@sigstore/mock@0.6.2","@sigstore/core@0.1.0","@sigstore/sign@2.2.0","@sigstore/mock@0.6.1","@sigstore/cli@0.5.0","@sigstore/mock@0.6.0","@sigstore/cli@0.4.0","@sigstore/tuf@2.2.0","@sigstore/mock@0.5.0","@sigstore/cli@0.3.0","sigstore@2.1.0","@sigstore/tuf@2.1.0","@sigstore/sign@2.1.0","@sigstore/mock@0.4.0","@sigstore/cli@0.2.1","@sigstore/bundle@2.1.0","sigstore@2.0.0","@sigstore/tuf@2.0.0","@sigstore/sign@2.0.0","@sigstore/rekor-types@2.0.0","@sigstore/mock@0.3.0","@sigstore/cli@0.2.0","@sigstore/bundle@2.0.0","sigstore@1.9.0","@sigstore/sign@1.0.0","@sigstore/mock@0.2.0","@sigstore/cli@0.1.2","@sigstore/bundle@1.1.0","sigstore@1.8.0","@sigstore/tuf@1.0.3","@sigstore/mock@0.1.1","@sigstore/cli@0.1.1","@sigstore/bundle@1.0.0","@sigstore/tuf@1.0.2","sigstore@1.7.0","@sigstore/tuf@1.0.1","@sigstore/mock@0.1.0","sigstore@1.6.0","@sigstore/tuf@1.0.0","@sigstore/rekor-types@1.0.0","@sigstore/cli@0.1.0","@sigstore/rekor-types@0.0.3","@sigstore/cli@0.0.5","sigstore@1.5.2","@sigstore/cli@0.0.4","@sigstore/cli@0.0.3","sigstore@1.5.1","@sigstore/rekor-types@0.0.2","@sigstore/cli@0.0.2","v1.5.0","v1.4.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.1","v1.1.0","v1.0.0","v1.0.0-beta.1","v0.4.0","v0.3.0","v0.2.0","v0.1.1","v0.1.0","v0.0.1-alpha.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48815.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}