Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dev.sigstore:sigstore-java | maven | = 2.0.0 | 2.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-qqw8-7c2r-jxch, is a regression in sigstore-java version 2.0.0. The core issue is the removal of a time-based validity check during signature verification.
The analysis of the provided commits confirms this. Commit 4b7a49ebb1813f5b1ff113bcad63246358222d61, which introduced the vulnerability, shows the explicit removal of the code that checks if the integratedTime from the Rekor log entry is within the validity period of the Fulcio signing certificate. This check, leafCert.checkValidity(entryTime), was located within the dev.sigstore.KeylessVerifier.verify method.
The fixing commit, b529335728fc5cfb574161b4b3c06859a8a2aa88, re-introduces this logic by passing the integratedTime to a verifyTimestamps helper function, where the leafCert.checkValidity() call is performed.
Therefore, the function dev.sigstore.KeylessVerifier.verify is the vulnerable function. During the exploitation of this vulnerability, this function would be called to verify a signature bundle, and it would incorrectly return a successful verification for a signature whose integratedTime is outside the certificate's validity period. A runtime profiler would show this function in the stack trace during a verification operation.
dev.sigstore.KeylessVerifier.verifysigstore-java/src/main/java/dev/sigstore/KeylessVerifier.java