EUVD-2026-62409
GHSA-rh24-296r-8rj6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticated peer presents valid federation token
-
DeliveryValidator uses mismatched timestamp resolution path
-
ExploitToken age computed incorrectly
-
ExecutionValid token flagged as expired
-
PersistFederation authentication rejected
-
ImpactFederation flow availability disrupted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | Exploitation requires three concurrent conditions: (1) the target node must be running stigmem-node version 0.9.0a1 specifically - no other versions are confirmed affected; (2) the node must have federation peer authentication paths enabled and actively in use, as this code path is not exercised in non-federation deployments; (3) the peer tokens in circulation must have been minted via a non-canonical (non-millisecond) path, creating the timestamp resolution mismatch. Authentication is required: the CVSS vector PR:L confirms that the impacting party must be an authenticated federation peer, not an unauthenticated external actor. The vulnerability does not permit privilege escalation, token forgery, or bypass of authentication - it only causes valid tokens to be erroneously rejected, limiting exploitation to denial of service against federation availability. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 and reflects a network-reachable, low-complexity availability impact requiring low privileges - consistent with an authenticated federation peer triggering the broken validation path. Critically, the impact is purely availability (VA:H); confidentiality and integrity are unaffected (VC:N/VI:N), meaning this bug cannot be used to forge tokens, escalate privileges, or access unauthorized data. The 'Information Disclosure' tag in the source metadata appears to be a tagging error - no evidence in the description, CVSS, or advisory supports confidentiality impact; this should be treated as mislabeled and disregarded. No EPSS score was provided, and no CISA KEV listing exists, meaning no confirmed in-the-wild exploitation has been observed. The product is in alpha release (0.9.0a1), which substantially narrows the real-world deployment footprint. Real-world priority is low-to-medium for affected operators: the bug is annoying and availability-impacting for federation flows, but it is not exploitable for data exfiltration or code execution, and the patch is already available. |
| Exploit ScenarioDerived | An authenticated federation peer on an affected Stigmem node running 0.9.0a1 presents a legitimately minted peer token over a network federation call. Because the token was minted via a path using a different timestamp resolution than the validator expects, the validator computes the token age incorrectly and rejects it as expired, causing the federation flow to fail. No public exploit code exists; the scenario is a logic-error-induced denial of availability rather than an intentional attack path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Availability disruption in stigmem-node 0.9.0a1 (pip package by eidetic-labs) allows authenticated federation peers to have their valid peer tokens incorrectly rejected as expired due to a timestamp-handling mismatch in the federation peer-token validation logic. Impacted deployments are Stigmem nodes operating federation peer authentication paths, where authenticated federation flows may fail non-deterministically depending on which token-minting path was used. No active exploitation has been identified (no KEV listing, no public exploit), and the fix is available in 0.9.0a2.
RemediationAI
The primary fix is to upgrade to stigmem-node 0.9.0a2 or later, which resolves the timestamp-handling mismatch by standardizing on the canonical millisecond-based validation path. Upgrade via pip using 'pip install --upgrade --pre stigmem-node', or if using the Stigmem meta-package, use 'pip install --upgrade --pre stigmem[node]'. The advisory is at https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-xh5j-xjfq-qvvx and the changelog details are at https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35. As a pre-upgrade workaround, the advisory recommends avoiding mixed peer-token minting paths and restricting federation use to tightly controlled peers - this reduces the chance of hitting the mismatched path but does not eliminate the underlying bug. The trade-off of the workaround is reduced federation flexibility and is not a permanent substitute for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Stigmem-node (CPE: cpe:2.3:a:eidetic-labs:stigmem:*:*:*:*:*:*:*:*) is an alpha-stage Python package distributed via pip that implements a federated node architecture using peer-token-based authentication. The root cause is CWE-345 (Insufficient Verification of Data Authenticity): specifically, a mismatch between the timestamp resolution used during peer-token minting and the resolution expected during peer-token validation. When the minting path emits tokens with one timestamp encoding (e.g., seconds-based) and the validation path expects another (milliseconds-based, which is the canonical path fixed in 0.9.0a2), valid tokens are arithmetically compared against the wrong epoch scale and evaluated as expired. The fix introduces a single canonical millisecond-based validation path with regression test coverage. The CWE-345 classification is broadly accurate in that the system fails to correctly authenticate the temporal component of a credential, though it manifests as a false-negative (rejecting valid tokens) rather than the more dangerous false-positive (accepting invalid tokens).
Know when Stigmem gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-accessible federation path requires low-privilege authenticated peer; purely availability impact with no confidentiality or integrity consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using federation peer authentication paths. The issue is fixed in 0.9.0a2, which uses the canonical millisecond-based validation path.
Executive ViewAI
stigmem-node 0.9.0a1 contains a defect in federation peer-token validation causing valid credentials to be intermittently rejected; no public exploit identified at time of analysis. Organizations operating Stigmem node clusters for federation face unpredictable communication disruptions between trusted peers. This impacts network availability and operational resilience for federated deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Anonymous read/write/federation access to Stigmem nodes (versions before 0.9.0a2) is possible when operators disable aut
Federation peer-registration authentication bypass in stigmem-node 0.9.0a1 lets a network-positioned attacker enroll a r
Cleartext exposure of federation traffic in eidetic-labs stigmem-node (versions before 0.9.0a2) occurs when operators ex
Cross-tenant broken object level authorization (BOLA) in stigmem-node exposes quarantined facts across tenant boundaries
SQL injection in stigmem-node 0.9.0a1 stems from PostgreSQL schema identifiers being interpolated into SQL strings witho
Arbitrary code execution is possible in stigmem-node versions before 0.9.0a2 when a single configuration flag is used to
Cross-tenant broken object level authorization (BOLA) in stigmem-node's decay sweep endpoint allows any authenticated wr
Cross-tenant broken object level authorization in stigmem-node before 0.9.0a12 allows an authenticated tenant in a multi
Blind Server-Side Request Forgery in Stigmem before 0.9.0a11 allows authenticated users to redirect the application serv
Exploit-DB