CVE-2026-49834

Name of the Vulnerable Software and Affected Versions sigstore-go versions prior to 1.2.0

Description A flaw exists in the verification process when configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1). The system counts verified witnesses per entry or per validation path instead of per log authority. This allows a single compromised transparency log or Certificate Transparency (CT) log to forge multiple entries or verify multiple times, satisfying multi-log threshold requirements and bypassing the intended multi-log security policy.

Recommendations Update to version 1.2.0.