Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the fact that certificateOIDs verification constraints were silently ignored. This was due to a series of omissions in the verification process. First, the createVerificationPolicy function in packages/client/src/config.ts did not process the certificateOIDs option from the user, so these constraints were never added to the verification policy. Second, the getSigner function in packages/verify/src/key/index.ts did not extract OID extensions from the signing certificate, so there was nothing to compare against. Finally, the main verification logic within the Verifier class in packages/verify/src/verifier.ts was missing the step to actually perform the OID check. The patch addresses all three issues by adding the necessary logic to create the policy with OIDs, extract OIDs from the certificate, and then verify them.
createVerificationPolicypackages/client/src/config.ts
Verifier.verifypackages/verify/src/verifier.ts
getSignerpackages/verify/src/key/index.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sigstore | npm | <= 4.1.0 | 4.1.1 |