CVE-2026-24408
Unknown
Description
sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. `_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value. Version 4.2.0 contains a patch for the issue.
SeverityUnknown
CVSS0.0
Exploit probability—
ProductLinuxfoundation Sigstore-python
PublishedJan 26, 2026
First seenJan 26, 2026
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- linuxfoundation sigstore-python4.2.0 or later
- sigstore4.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation sigstore-python | v < 4.2.0 | 4.2.0 |
| sigstorePyPI | v < 4.2.0 | 4.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.