sigstore-js EUVD-2026-44494

Exploitation requires that the target application invokes sigstore.verify() or createVerifier()/createVerificationPolicy() with the certificateOIDs option set and treats those OID/value pairs as a security-relevant restriction - this is a non-default, opt-in usage, not the library baseline. The attacker must also present a signing bundle whose certificate satisfies every other enforced check (the SAN/certificateIdentityEmail and certificateIssuer settings) while lacking or mismatching the OID extensions that were supposed to be required. Limiting factors: applications that do not use certificateOIDs are unaffected; applications relying only on issuer/SAN are unaffected; and the attacker cannot bypass the SAN and issuer constraints, so they still need a certificate valid under those. No user interaction or prior authentication to the verifier is needed.

The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), reflecting an integrity-only impact with no confidentiality or availability loss - consistent with a verification bypass rather than code execution or data disclosure. A working PoC exists, which raises practical concern, but this is not active exploitation and is not KEV-listed; EPSS was not provided. Crucially, real-world risk is gated by configuration: the flaw only matters for applications that actually pass certificateOIDs and rely on it as a security control, and an attacker still needs a certificate that satisfies the remaining SAN/issuer checks. Because those limiting factors are not captured in the CVSS vector, the AC:L / PR:N rating likely overstates typical exploitability - I assess attack complexity as higher (see assessed vector). Net: a genuine trust-boundary weakness for the subset of deployments using OID pinning, but lower blast radius than a raw 7.5 suggests for default configurations.

An organization verifies signed artifacts with sigstore.verify() and passes certificateOIDs to require a workload-identity extension that only its trusted build system's Fulcio certificates carry. Because that constraint is silently discarded, an attacker who obtains any certificate matching the configured issuer and identity - but lacking the required OID - can produce a bundle that passes verification, and the application accepts a malicious artifact it should have rejected. A PoC demonstrating that certificateOIDs is absent from the constructed policy is published in the advisory.