Sigstore Timestamp Authority implements RFC 3161 timestamp verification, but the VerifyTimestampResponse function only verifies the signature chain and then incorrectly applies TSA‑specific constraints to the first non‑CA certificate in the PKCS#7 bag instead of the leaf certificate of the verified chain. An attacker can prepend a forged certificate to the bag while the signed message remains valid, causing the library to validate the signature against one certificate and apply authorization checks against another. This flaw allows an attacker to bypass authorization checks and potentially obtain timestamp responses that appear legitimately signed by an authorized key.

The affected product is the sigstore timestamp‑authority service. Versions 2.0.5 and earlier of the timestamp‑authority/v2/pkg/verification package are vulnerable. The issue was fixed in release 2.0.6.

The CVSS score is 5.5, indicating a moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted PKCS#7 certificate bag to a client that uses VerifyTimestampResponse; the service itself is not vulnerable. Attackers could thus forge timestamp responses that pass verification but bypass the intended authorization checks.