CVE-2026-24408None· 0.0▾ Sunlitsigstore CSRF possibility in OIDC authentication during signing
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
0.2% → 0.2%
The sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery.
_OAuthSession creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value.
Fix should be fairly trivial.
This should be low impact: A man-in-the middle attacker could trick a sigstore-python user into signing something with an identity controlled by the attacker (by returning the response to an authentication request they created). This would be quite confusing but not dangerous.
sigstore < 4.2.0Upgrade to a patched release:
sigstore 4.2.0Connected by shared product, vendor, weakness, or advisory.
CVE-2024-55655Lowsigstore has insufficient validation of integration timestamp during verification
CVE-2024-29902Medium· 4.2Cosign malicious attachments can cause system-wide denial of service
CVE-2026-44309Medium· 5.3gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits
CVE-2026-44310Medium· 5.4gitsign --verify panics on empty-certificate PKCS7 and exits 0, bypassing exit-code callers
CVE-2022-35930High· 7.1PolicyController before 0.2.1 may bypass attestation verification
CVE-2026-22772Medium· 5.8Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass