CVE-2026-39984

Medium

Published: —Translated: 17/06/2026(UTC)NVD NIST

Summary

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function.

Risk Assessment

This vulnerability may allow unauthorized issuance of timestamps, potentially leading to data falsification or time-related fraud.

Recommendation

It is recommended to upgrade to version 2.0.6 or later to mitigate this vulnerability.

Original NVD description (English source)

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint check