CVE-2026-24408: CSRF in sigstore-python OAuth Flow

The impact of this CSRF vulnerability is considered low. An attacker would need to successfully execute a man-in-the-middle attack to exploit it. The attacker could craft a malicious request that, when triggered by a user, would cause sigstore-python to sign data using the attacker's identity instead of the user's. This could lead to unauthorized code signing or other actions performed with the user's credentials. While the technical feasibility exists, the reliance on a MITM attack limits the practical exploitability.

1. Reserved2026-01-22
2. Published2026-01-26
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24408 is to upgrade to sigstore-python version 4.2.0 or later, which contains the fix. If upgrading is not immediately possible, consider implementing additional security measures. User awareness training is crucial to educate users about the risks of phishing and malicious websites. Restricting OAuth flows to trusted origins can also help mitigate the risk. While not a direct fix, implementing strong authentication practices and regularly reviewing OAuth application permissions can reduce the attack surface.