CVE-2026-24408: 
Python vulnerability analysis and mitigation

CVE-2026-24408 is a Cross-Site Request Forgery (CSRF) vulnerability in the OAuth/OIDC authentication flow of sigstore-python, a Python tool for generating and verifying Sigstore signatures. The vulnerability affects all versions of the sigstore pip package prior to 4.2.0. It was discovered and disclosed on January 26, 2026, with a patch released the same day. The GitHub Advisory Database rates this as Low severity with a CVSS v3.1 base score of 0.0 (per the official advisory's C:N/I:N/A:N vector), while Feedly's estimate assigns a score of 5.0 (Medium) (GitHub Advisory, sigstore Advisory).

The root cause is CWE-352 (Cross-Site Request Forgery): the _OAuthSession class generates a unique state parameter and includes it in the outgoing OIDC authentication request, but the state value returned in the identity provider's response is never validated against the originally sent value (GitHub Advisory). This missing state validation in sigstore/oidc.py means an attacker positioned as a man-in-the-middle could substitute their own authorization response — including a state and code they control — without triggering any error. The fix, introduced in commit 5e77497, adds an explicit check (if server.auth_response["state"][0] != server.oauth_session.state: raise IdentityError("OAuth state mismatch")) to enforce state binding (Patch Commit). Exploitation requires network-level access (e.g., MITM position) and user interaction, making it a high-complexity attack.

A successful exploit could allow a man-in-the-middle attacker to trick a sigstore-python user into completing an OIDC authentication flow using an authorization code obtained by the attacker, effectively causing the victim to sign an artifact under an identity controlled by the attacker rather than their own (sigstore Advisory). The official advisory characterizes this as "quite confusing but not dangerous," as the signing operation itself would still be cryptographically valid — just attributed to the wrong identity. There is no direct confidentiality, integrity, or availability impact to the host system; the primary risk is identity confusion in the software supply chain signing process (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.006–0.007%, placing it in the 1st percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a high-complexity attack scenario involving a network-based man-in-the-middle position and user interaction, significantly limiting practical exploitability.

1. Positioning: Attacker establishes a man-in-the-middle position between the victim's sigstore-python client and the OIDC identity provider (e.g., via ARP spoofing, DNS poisoning, or a rogue network).
2. Initiate legitimate signing: The victim runs sigstore sign, which triggers _OAuthSession to generate a state parameter and open a browser to the OIDC authorization URL.
3. Intercept and substitute: The attacker intercepts the OIDC redirect response from the identity provider and replaces the state and code values with those from an authorization request the attacker previously initiated under their own controlled identity.
4. Exploit missing validation: Because sigstore-python (pre-4.2.0) does not validate that the returned state matches the session's original state, the substituted response is accepted without error.
5. Fraudulent signing: The victim's sigstore-python client exchanges the attacker's code for a token tied to the attacker's identity, causing the artifact to be signed under the attacker's OIDC identity rather than the victim's (sigstore Advisory, Patch Commit).

• Logs: Sigstore signing operations that complete successfully but result in a certificate/identity in the transparency log that does not match the expected signer's email or OIDC subject.
• Network: Unexpected modification or substitution of OIDC redirect responses (HTTP 302 or callback requests) observed in network traffic captures, particularly mismatches between the state parameter in the outgoing authorization request and the incoming callback.
• Application Behavior: Signed artifacts whose Sigstore bundle identity (OIDC subject/issuer) does not correspond to the user who initiated the signing operation — detectable by verifying the bundle's certificate subject against the expected signer.

Upgrade sigstore (pip) to version 4.2.0 or later, which adds explicit state parameter validation in the OIDC flow to prevent CSRF (v4.2.0 Release). No configuration-based workaround is available for versions prior to 4.2.0; upgrading is the only remediation. As a general defense-in-depth measure, ensure signing operations are performed over trusted networks to reduce MITM exposure.

The vulnerability was reported by researcher jku (Jussi Kukkonen), who also authored the fix, keeping the patch minimal and focused on the state validation gap (Patch Commit). The sigstore project maintainers characterized the impact as low, noting the scenario is "quite confusing but not dangerous" (sigstore Advisory). Community reaction has been minimal given the low severity and limited real-world exploitability.