CVSS 3.1
5.0 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:LCVE-2026-24408
Medium (5.0) in linuxfoundation sigstore-python. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in sigstore 4.2.0.
sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. `_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value. Version 4.2.0 contains a patch for the issue.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linuxfoundation:sigstore-python
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hm8f-75xx-w2vr | PyPI | sigstore | <4.2.0 | 4.2.0 |
| PYSEC-2026-1924 | PyPI | sigstore | <4.2.0 | 4.2.0 |