sigstore-js stores authorization and Docker configuration headers on a shared HTTP client and then sends these headers to any absolute blob-upload location supplied by the registry, without validating that the target host matches the registry origin. This allows a malicious or compromised registry to redirect a client during artifact upload to an attacker‑controlled host and capture bearer tokens, Basic credentials, or custom authentication headers. The flaw is a direct leakage of credential material, raising confidentiality risks to any user interacting with the vulnerable library.

The vulnerable component is the sigstore-js JavaScript library, used to interact with Sigstore services. All releases prior to 0.7.2 are affected, including 0.7.1 and earlier. The fix is released in version 0.7.2, which separates registry credentials from client‑wide defaults and ensures they are only sent to the registry origin.

The CVSS score of 7.4 indicates a high potential impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring the attacker to control or manipulate the registry’s upload URL. An attacker can then obtain sensitive authentication tokens, enabling further credential‑based attacks such as unauthorized access to protected resources or services.