CVE-2026-88819

6.3 mediumEPSS 0.2%

Medium (6.3). EPSS 0.2% chance of exploitation in the next 30 days.

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.

Severity

6.3 medium

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-31)
CWEs: CWE-290, CWE-345
Published: 2026-09-14
Modified: 2026-09-16
Record from: the NVD, synced 2026-10-19