CVE-2026-48816

Name of the Vulnerable Software and Affected Versions sigstore-js versions prior to 3.1.1

Description The @sigstore/verify library incorrectly derives a transparency-log timestamp from the tlogEntries[].integratedTime variable for bundle v0.2 inclusionProof-only entries. Because the inclusion proof path does not cryptographically bind integratedTime, an attacker providing an untrusted bundle can manipulate this value to influence certificate validity and timestampThreshold verification decisions. This creates a trust gap where an unauthenticated timestamp is treated as a trusted observer timestamp.

Recommendations Update to version 3.1.1.