low
CVE-2026-24408
sigstore CSRF possibility in OIDC authentication during signing
Impact
### Summary The sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. ### Details `_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value. Fix should be fairly trivial. ### Impact This should be low impact: A man-in-the middle attacker could trick a sigstore-python user into signing something with an identity controlled by the attacker (by returning the response to an authentication request they created). This would be quite confusing but not dangerous.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | sigstore | < 4.2.0 | 4.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linuxfoundation | Sigstore-Python | before 4.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sigstore/sigstore-python/commit/5e77497fe8f0b202bdd118949074ec2f20da69aa
- https://github.com/sigstore/sigstore-python/releases/tag/v4.2.0
- https://github.com/sigstore/sigstore-python/security/advisories/GHSA-hm8f-75xx-w2vr
- https://github.com/advisories/GHSA-hm8f-75xx-w2vr
- https://nvd.nist.gov/vuln/detail/CVE-2026-24408