EUVD-2026-62409
GHSA-rh24-296r-8rj6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible federation path requires low-privilege authenticated peer; purely availability impact with no confidentiality or integrity consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using federation peer authentication paths. The issue is fixed in 0.9.0a2, which uses the canonical millisecond-based validation path.
AnalysisAI
Availability disruption in stigmem-node 0.9.0a1 (pip package by eidetic-labs) allows authenticated federation peers to have their valid peer tokens incorrectly rejected as expired due to a timestamp-handling mismatch in the federation peer-token validation logic. Impacted deployments are Stigmem nodes operating federation peer authentication paths, where authenticated federation flows may fail non-deterministically depending on which token-minting path was used. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target node must be running stigmem-node version 0.9.0a1 specifically - no other versions are confirmed affected; (2) the node must have federation peer authentication paths enabled and actively in use, as this code path is not exercised in non-federation deployments; (3) the peer tokens in circulation must have been minted via a non-canonical (non-millisecond) path, creating the timestamp resolution mismatch. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 and reflects a network-reachable, low-complexity availability impact requiring low privileges - consistent with an authenticated federation peer triggering the broken validation path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated federation peer on an affected Stigmem node running 0.9.0a1 presents a legitimately minted peer token over a network federation call. Because the token was minted via a path using a different timestamp resolution than the validator expects, the validator computes the token age incorrectly and rejects it as expired, causing the federation flow to fail. … |
| Remediation | The primary fix is to upgrade to stigmem-node 0.9.0a2 or later, which resolves the timestamp-handling mismatch by standardizing on the canonical millisecond-based validation path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Identify all stigmem-node 0.9.0a1 deployments using federation peer authentication within 24 hours. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Anonymous read/write/federation access to Stigmem nodes (versions before 0.9.0a2) is possible when operators disable aut
Federation peer-registration authentication bypass in stigmem-node 0.9.0a1 lets a network-positioned attacker enroll a r
Cleartext exposure of federation traffic in eidetic-labs stigmem-node (versions before 0.9.0a2) occurs when operators ex
Cross-tenant broken object level authorization (BOLA) in stigmem-node exposes quarantined facts across tenant boundaries
SQL injection in stigmem-node 0.9.0a1 stems from PostgreSQL schema identifiers being interpolated into SQL strings witho
Arbitrary code execution is possible in stigmem-node versions before 0.9.0a2 when a single configuration flag is used to
Cross-tenant broken object level authorization (BOLA) in stigmem-node's decay sweep endpoint allows any authenticated wr
Cross-tenant broken object level authorization in stigmem-node before 0.9.0a12 allows an authenticated tenant in a multi
Blind Server-Side Request Forgery in Stigmem before 0.9.0a11 allows authenticated users to redirect the application serv
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today