https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:00:36.785118+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-sigstore-cve-2026-24408 BREW-sigstore-CVE-2026-24408 — sigstore has CSRF possibility in OIDC authentication during signing 2026-10-03T19:00:36.874572+00:00

Affected: Homebrew: sigstore

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. `_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value. Version 4.2.0 contains a patch for the issue.

 https://cve.radiocsirt.org/vuln/euvd-2026-266742 EUVD-2026-266742 2026-10-03T19:00:36.874633+00:00 EUVD-2026-266742 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24408 fkie_cve-2026-24408 2026-10-03T19:00:36.874649+00:00

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. `_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value. Version 4.2.0 contains a patch for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-hm8f-75xx-w2vr GHSA-hm8f-75xx-w2vr — sigstore CSRF possibility in OIDC authentication during signing 2026-10-03T19:00:36.874675+00:00

Affected: PyPI: sigstore

### Summary

The sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery.

### Details

`_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value.

Fix should be fairly trivial.

### Impact

This should be low impact: A man-in-the middle attacker could trick a sigstore-python user into signing something with an identity controlled by the attacker (by returning the response to an authentication request they created). This would be quite confusing but not dangerous.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10104-1 openSUSE-SU-2026:10104-1 — python311-sigstore-4.2.0-1.1 on GA media 2026-10-03T19:00:36.874703+00:00

python311-sigstore-4.2.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-1924 PYSEC-2026-1924 — sigstore CSRF possibility in OIDC authentication during signing 2026-10-03T19:00:36.874720+00:00

Affected: PyPI: sigstore

### Summary

The sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery.

### Details

`_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state" in the server response seems not not be cross-checked with this value.

Fix should be fairly trivial.

### Impact

This should be low impact: A man-in-the middle attacker could trick a sigstore-python user into signing something with an identity controlled by the attacker (by returning the response to an authentication request they created). This would be quite confusing but not dangerous.