GitHub Advisoryadvisory · PyPI
GHSA-hm8f-75xx-w2vr sigstore CSRF possibility in OIDC authentication during signing
LOW
Official page ↗
- Aliases
- CVE-2026-24408
- Ecosystem
- PyPI
- Packages
- sigstore
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N
- Weaknesses
- CWE-352
- Reviewed
- 2026-01-26
Affected packages
• PyPI sigstore: < 4.2.0 → fixed in 4.2.0
Description
Summary
The sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery.
Details
`_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value.
Fix should be fairly trivial.
Impact
This should be low impact: A man-in-the middle attacker could trick a sigstore-python user into signing something with an identity controlled by the attacker (by returning the response to an authentication request they created). This would be quite confusing but not dangerous.
Related
Alias · CVE (1)
- CVE-2026-24408 sigstore-python is a Python tool for generating and verifying Sigstore signatures. vulnerability
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://github.com/sigstore/sigstore-python/security/advisories/GHSA-hm8f-75xx-w2vr web
- https://nvd.nist.gov/vuln/detail/CVE-2026-24408 advisory
- https://github.com/sigstore/sigstore-python/commit/5e77497fe8f0b202bdd118949074ec2f20da69aa web
- https://github.com/sigstore/sigstore-python package
- https://github.com/sigstore/sigstore-python/releases/tag/v4.2.0 web