CVE-2026-24408 sigstore has CSRF possibility in OIDC authentication during signing
Attackers can exploit missing state validation in OAuth flows to perform Cross-Site Request Forgery, potentially compromising user accounts during signing operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-24408?
CVE-2026-24408 is a vulnerability in sigstore-python, published on 26 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. `_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value. Version 4.2.0 contains a patch for the issue.
Weakness: CWE-352
Which versions are affected by CVE-2026-24408?
3 open source packages ship an affected version, including sigstore. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sigstore PyPI | All versions | 4.2.0 |
sigstore PyPI | All versions | 4.2.0 |
sigstore PyPI | All versions | 4.2.0 |
Linux distribution packages (1)
python-sigstore openSUSE:Tumbleweed | All versions | 4.2.0-1.1 |
Products include Linuxfoundation Sigstore-Python.
How do I fix CVE-2026-24408?
Upgrade sigstore to 4.2.0 or later.
Is CVE-2026-24408 being exploited?
There is no known exploitation of CVE-2026-24408 in the wild and no public exploit code.
Sources
Also known as GHSA-hm8f-75xx-w2vr, PYSEC-2026-1924, openSUSE-SU-2026:10104-1.