Authentication Bypass in stigmem-node Affects Peer Registration Process

CVE-2026-76242

What is CVE-2026-76242?

The stigmem-node version 0.9.0a1 is susceptible to an authentication bypass during the federation peer registration process. This vulnerability allows an attacker to register a malicious peer by accepting key material without a mandatory out-of-band fingerprint approval from an administrator. If an initial registration is intercepted over the network, the attacker can manipulate federation traffic, leading to potential unauthorized access and data tampering. The issue has been addressed in version 0.9.0a2, which implements a pending approval mechanism requiring administrator fingerprint verification prior to accepting peer tokens.

References