CVE-2026-39984

CVE-2026-39984 is an authorization bypass vulnerability in Sigstore Timestamp Authority versions 2.0.5 and below, specifically affecting the timestamp-authority/v2/pkg/verification package. The vulnerability exists in the VerifyTimestampResponse function, which fails to validate authorization checks against the correct certificate from the verified chain, instead checking against a certificate that could be forged and prepended to the certificate bag. This allows attackers to bypass authorization controls while maintaining a valid signature from an authorized key. The vulnerability carries a CVSS severity rating of 5.5 MEDIUM with a local attack vector requiring minimal complexity and user interaction. The primary impact is integrity compromise, as attackers can forge timestamp responses that appear legitimate. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) indicates the attack requires local access and user action but poses no confidentiality or availability risks. There is currently no evidence of active exploitation, as this vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows minimal community attention relative to other CVEs. The EPSS score of 0.00008 suggests a very low probability of exploitation in the wild. The issue has been remediated in version 2.0.6, and affected organizations should prioritize upgrading to address the authorization bypass risk.