Authorization Bypass in Sigstore Timestamp Authority Affects Multiple Versions
CVE-2026-39984

5.5MEDIUM

Key Information:

Vendor

Sigstore

Status
Timestamp-authority
Vendor
CVE Published:
14 April 2026

What is CVE-2026-39984?

The Sigstore Timestamp Authority, particularly versions 2.0.5 and earlier, is vulnerable to an authorization bypass issue in the VerifyTimestampResponse function. This vulnerability arises due to improper checks in the VerifyLeafCert where a forgery technique can allow an attacker to prepend a malicious certificate to the PKCS#7 certificate bag. While the certificate chain’s signature is correctly verified, the authorization checks may be performed against this forged certificate instead of the validated leaf certificate. Users of the timestamp-authority/v2/pkg/verification package are affected, and this issue does not impact the overall timestamp-authority service or sigstore-go. The vulnerability has been addressed in version 2.0.6.

Affected Version(s)

timestamp-authority < 2.0.6

References

https://github.com/sigstore/timestamp-authority/security/...
x_refsource_CONFIRM
https://github.com/sigstore/timestamp-authority/releases/...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.