Sigstore Java client version 2.0.0 mistakenly removed verification that the integrated time recorded in a Rekor entry matches the validity period of its Fulcio certificate. This oversight means artifacts signed with an expired or otherwise invalid Fulcio certificate could still be accepted as authentic by users relying on that client. An attacker who acquires the temporary private key used during signing could later employ an older Fulcio certificate to create signatures that the vulnerable client would treat as legitimate, creating the appearance of a trustworthy artifact without real authorization.

Only dev.sigstore:sigstore-java 2.0.0 is impacted; earlier releases are unaffected and the deficiency was fixed in 2.1.0 and later. Users who employ 2.0.0 for bundle verification and store or reuse the temporary signing key are at risk.

With a CVSS score of 2, the vulnerability is assessed as low severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires local or otherwise privileged access sufficient to exfiltrate the temporary signing key; after obtaining the key, an attacker can reuse an old Fulcio certificate to sign artifacts or claims that the client will accept as valid. This does not provide direct system compromise but can lead to supply-chain compromise or authentication abuse if the fraudulent artifacts are trusted.