CVE-2026-39984

[CVE catalog]

Severity

Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Published

Apr 14, 2026, 11:41:47 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.10% · Oct 25, 2026

A flaw was found in timestamp-authority, specifically in the timestamp-authority/v2/pkg/verification package. An attacker can exploit this issue by prepending a forged certificate to the certificate bag while the message is signed with an authorized key. This causes the library to validate the signature against one certificate but perform authorization checks against another, leading to an authorization bypass. timestamp-authority/v2/pkg/verification: improper certificate validation in verifier This vulnerability allows an attacker to bypass authorization checks by prepending a forged certificate to the certificate bag. The library validates the signature against one certificate while performing authorization checks against another. Additionally, a user or an automated system must actively run the `VerifyTimestampResponse` function against the attacker-supplied payload. Due to this reason, this flaw has been rated with a moderate severity. This issue only impacts users of the `timestamp-authority/v2/pkg/verification` package and does not affect the `timestamp-authority` service or `sigstore-go`. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.