Is CVE-2026-48816 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48816 being exploited in the wild.

How severe is CVE-2026-48816?

Medium severity, with a CVSS score of 6.5, published 14 July 2026.

Which products and versions are affected?

@sigstore/verify (npm) = 3.1.0, SEMVER:introduced=3.1.0,fixed=3.1.1; Sigstore-Js < 3.1.1; Sigstore Verify 3.1.0.

Is there a fix for CVE-2026-48816?

Yes. @sigstore/verify (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48816 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48816?

Check whether you run @sigstore/verify (npm), Sigstore-Js or Sigstore Verify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48816: sigstore-js insufficient verification of data authenticity in @sigstore/verify

Q: Is there a fix for CVE-2026-48816?

Yes. @sigstore/verify (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48816 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48816?

Check whether you run @sigstore/verify (npm), Sigstore-Js or Sigstore Verify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48816 · Severity: medium · CVSS 6.5 · Published 2026-07-14

Sigstore-js is a JavaScript library used to verify the authenticity of software signatures and security certificates. A flaw in the verification process allows an attacker to provide a specially crafted data bundle that manipulates the recorded time of a signature. This could allow an attacker to bypass security checks that ensure a certificate was valid at the time of signing, potentially leading to the acceptance of untrusted or expired software.

Technologies: Sigstore-Js. Vendors: npm, Sigstore.

Quick answers

Is CVE-2026-48816 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48816 being exploited in the wild.
How severe is CVE-2026-48816?: Medium severity, with a CVSS score of 6.5, published 14 July 2026.
Which products and versions are affected?: @sigstore/verify (npm) = 3.1.0, SEMVER:introduced=3.1.0,fixed=3.1.1; Sigstore-Js < 3.1.1; Sigstore Verify 3.1.0.
Is there a fix for CVE-2026-48816?: Yes. @sigstore/verify (npm): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48816 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48816?: Check whether you run @sigstore/verify (npm), Sigstore-Js or Sigstore Verify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sigstore/verify (npm): upgrade to 3.1.1 or later
```
npm install @sigstore/verify@3.1.1
```

Technical details

The @sigstore/verify package within sigstore-js incorrectly derives transparency log timestamps from the 'integratedTime' field for bundle v0.2 inclusionProof-only entries. Because the inclusion proof path does not cryptographically bind this field, an attacker providing an untrusted bundle can manipulate the timestamp. This allows the attacker to influence certificate validity windows and satisfy 'timestampThreshold' verification requirements. The vulnerability is rooted in the library treating 'integratedTime' as a trusted observer timestamp even when it lacks a signed inclusionPromise or set. This issue is resolved in version 3.1.1 by requiring a cryptographically bound time source for these verification decisions.

Affected products

sigstore sigstore-js (@sigstore/verify) < 3.1.1

Identifiers

CVE-2026-48816
GHSA-xgjw-pm74-86q4

Timeline

2026-05-22: patched: Fix merged in pull request 1659
2026-07-14: disclosed: CVE-2026-48816 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.