CVE-2026-48815

Name of the Vulnerable Software and Affected Versions sigstore-js versions prior to 4.1.1

Description The certificateOIDs option in the sigstore.verify() function is accepted by the public API but discarded before the verification process occurs. Consequently, required certificate extension Object Identifiers (OIDs)—numeric identifiers used to uniquely identify objects in a directory tree—are never checked. This allows applications that rely on certificateOIDs to restrict which certificates can sign artifacts to inadvertently accept unauthorized certificates, provided they satisfy other verification checks.

Recommendations Update to version 4.1.1.