Cross-Site Request Forgery in Sigstore-Python Auth Flow Vulnerability

CVE-2026-24408

What is CVE-2026-24408?

The sigstore-python tool, utilized for generating and verifying Sigstore signatures, has a vulnerability within its OAuth authentication flow. Prior to version 4.2.0, this flow fails to properly validate the state's value sent back from the server in response. Specifically, the _OAuthSession component generates a unique 'state' parameter for authentication requests but does not verify if the returned 'state' matches the initially generated value. This oversight exposes users to potential Cross-Site Request Forgery attacks, compromising their session integrity. The issue has been addressed in version 4.2.0, which includes the necessary patch.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References