7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-xh5j-xjfq-qvvx

GHSA-xh5j-xjfq-qvvx: stigmem-node's federation peer token timestamp validation may reject valid peer tokens

Impact

A mismatch in federation peer-token timestamp handling could cause valid peer tokens to be treated as expired. Impacted deployments are Stigmem nodes using federation peer authentication paths from affected versions. The primary impact is availability and reliability of authenticated federation flows.

Patches

Patched in 0.9.0a2. Federation peer-token timestamp handling now uses the canonical millisecond-based validation path and is covered by regression tests.

Workarounds

Before upgrading, avoid mixed peer-token minting paths and restrict federation use to tightly controlled peers.

Upgrade

Upgrade to the patched release:

pip install --upgrade --pre stigmem-node

If developers install through the Stigmem meta-package instead, they should use the matching extra for deployments, for example:

pip install --upgrade --pre 'stigmem[node]'

Resources

Release: https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2
Changelog: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md#L14-L35
Security policy and posture: https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-xh5j-xjfq-qvvx

GHSA-xh5j-xjfq-qvvx:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
stigmem-node	pip	< 0.9.0a2	0.9.0a2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in inconsistent and overly strict timestamp validation of federation peer tokens across two different modules, stigmem_node.federation.peer_token and stigmem_node.peer_auth. Both modules contain a verify_peer_token function responsible for validating tokens from peer nodes.

Before the patch, the validation logic in both functions did not properly handle timestamps, specifically the exp, iat, and nbf claims. The code did not consistently treat timestamps as millisecond-based values and lacked a tolerance for small clock skews between the systems. This resulted in a race condition where recently issued, valid tokens could be incorrectly flagged as expired or not yet valid, leading to a denial of service for federated authentication.

The patches address this by:

Introducing a configurable leeway (peer_token_leeway_s) to the timestamp comparisons, making the validation more resilient to clock drift.
Ensuring all timestamp claims are parsed as integers representing milliseconds, creating a canonical validation path.
Adding explicit checks for iat (issued at) and nbf (not before) claims to prevent tokens from the future or too far in the past from being accepted.

The analysis of the commits between the last vulnerable version and the first patched version revealed changes in stigmem_node.federation.peer_token.verify_peer_token and stigmem_node.peer_auth.verify_peer_token. These changes directly correspond to the vulnerability description, confirming that these two functions are the vulnerable ones.

Vulnerable functions

stigmem_node.federation.peer_token.verify_peer_token

node/src/stigmem_node/federation/peer_token.py

The function `verify_peer_token` in `stigmem_node.federation.peer_token` was vulnerable to incorrectly rejecting valid peer tokens due to strict timestamp validation. The original implementation did not account for minor clock skew between federated nodes, causing tokens that were still valid to be treated as expired. The patch introduces a leeway for the expiration check and adds more robust validation for `iat` and `nbf` claims to handle timestamps in milliseconds consistently.

stigmem_node.peer_auth.verify_peer_token

node/src/stigmem_node/federation/peer_auth.py

Similar to its counterpart in `peer_token.py`, the `verify_peer_token` function in `stigmem_node.peer_auth` also had a flaw in its timestamp validation logic. It lacked proper handling of timestamp claims, which could lead to valid tokens being rejected. The patch rectifies this by introducing a helper function to consistently parse timestamp claims as milliseconds and by adding validation for `iat` and `nbf` claims with a configurable leeway to tolerate clock skew.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.